{"id":"T1199","name":"Trusted Relationship","url":"https://attack.mitre.org/techniques/T1199","tactics":["initial-access"],"platforms":["IaaS","Identity Provider","Linux","macOS","Office Suite","SaaS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0488","stix_id":"x-mitre-detection-strategy--2f7a5ebd-e025-4822-aed2-46fc3ec1a0a9","name":"Detect abuse of Trusted Relationships (third-party and delegated admin access)","url":"https://attack.mitre.org/detectionstrategies/DET0488","analytics":[{"id":"AN1344","stix_id":"x-mitre-analytic--46630fc8-75de-4b73-b46e-0a4eeb7ad310","name":"Analytic 1344","description":"Behavioral chain: (1) a login from a third-party account or untrusted source network establishes an interactive/remote session; (2) the session acquires elevated privileges or accesses sensitive resources atypical for that account; (3) subsequent lateral movement or data access occurs from the same session/device. Correlate Windows logon events, token elevation/privileged use, and resource access with third-party context.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1344","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Security","channel":"EventCode=4776, 4771, 4770","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Security","channel":"EventCode=4663, 4670, 4656","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"ThirdPartyCIDRs","description":"Ranges used by MSPs/contractors/VPN egress; used to enrich logons and network flows."},{"field":"ExpectedAdminHosts","description":"Servers where third-party admins are allowed; deviations raise risk."},{"field":"TimeWindow","description":"Correlation window linking logon → elevation → access (e.g., 30–120 minutes)."},{"field":"HighValueResources","description":"File shares/AD objects/servers that should never be touched by third-party sessions."}],"live":true,"detection_strategies":["DET0488"],"techniques":["T1199"]},{"id":"AN1345","stix_id":"x-mitre-analytic--e19cbf11-fabf-4dfd-aeb2-1c62660ebd8f","name":"Analytic 1345","description":"Behavioral chain: (1) sshd or federated SSO logins from third-party networks or identities; (2) rapid sudo/su privilege elevation; (3) access to sensitive paths or east-west SSH. Correlate auth logs, process execution, and network flows.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1345","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve,socket,connect,openat","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"auditd-syscall"},{"name":"linux:syslog","channel":"Accepted publickey/password for * from * port * ssh2","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"linux-syslog"},{"name":"NSM:Flow","channel":"ssh connections originating from third-party CIDRs","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ThirdPartyUsers","description":"POSIX accounts assigned to vendors/partners."},{"field":"AllowedJumpHosts","description":"Bastion hosts permitted for third-party access."},{"field":"MFAExpected","description":"Flag indicating whether PAM/MFA should be present; used to score risk."}],"live":true,"detection_strategies":["DET0488"],"techniques":["T1199"]},{"id":"AN1346","stix_id":"x-mitre-analytic--7c28e2f5-c944-4974-810f-81bcfdc8b6cc","name":"Analytic 1346","description":"Behavioral chain: (1) third-party interactive login or mobileconfig-based device enrollment; (2) privilege use or admin group change; (3) lateral movement mounts/ssh. Correlate unified logs and network telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1346","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"loginwindow or sshd successful login events","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Group membership change for admin or wheel","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"ssh/smb connections to internal resources from third-party devices","data_component":"DC0085","data_component_name":"Network Traffic Content","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ManagedDeviceList","description":"Known corp devices; treat unknown devices as higher risk."}],"live":true,"detection_strategies":["DET0488"],"techniques":["T1199"]},{"id":"AN1347","stix_id":"x-mitre-analytic--f0e2baa2-3bb7-4587-8eae-6abddd1cf140","name":"Analytic 1347","description":"Behavioral chain: (1) delegated admin or external identity establishes session (e.g., partner/reseller DAP, B2B guest, SAML/OAuth trust); (2) role elevation or app consent/permission grant; (3) downstream privileged actions in the tenant. Correlate IdP sign-in, admin/role assignment, and consent/admin-on-behalf events.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1347","platforms":["Identity Provider"],"log_source_references":[{"name":"azure:signinlogs","channel":"InteractiveUser, ServicePrincipalSignIn","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"azure-signinlogs"},{"name":"azure:audit","channel":"Add delegated admin / Assign admin roles / Update application consent","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"azure-audit"},{"name":"m365:unified","channel":"Set-PartnerOfRecord / CompanyAdministrator role assignments / New-DelegatedAdminRelationship","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"}],"mutable_elements":[{"field":"TrustedPartnerTenantIDs","description":"Tenant IDs of approved partners; any others are suspicious."},{"field":"RequiredMFA","description":"Require MFA for partner sessions; alert on bypass or step-up failure."},{"field":"RoleScopeAllowList","description":"Roles third-parties may hold (e.g., Helpdesk Admin); flag broader scopes."}],"live":true,"detection_strategies":["DET0488"],"techniques":["T1199"]},{"id":"AN1348","stix_id":"x-mitre-analytic--c526f8c1-95ec-494f-b7bf-49a95a803f2a","name":"Analytic 1348","description":"Behavioral chain: (1) cross-account or third-party principal assumes a role into the tenant/subscription/project; (2) privileged API calls are made in short succession; (3) access originates from unfamiliar networks or geos. Correlate assume-role/federation events with sensitive API usage.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1348","platforms":["IaaS"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"AssumeRole,AssumeRoleWithSAML,AssumeRoleWithWebIdentity","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"aws-cloudtrail"},{"name":"AWS:CloudTrail","channel":"CreateUser|AttachRolePolicy|CreateAccessKey|UpdateAssumeRolePolicy|CreateLoginProfile","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"aws-cloudtrail"},{"name":"gcp:audit","channel":"google.iam.credentials.generateAccessToken / serviceAccountTokenCreator","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"gcp-audit"}],"mutable_elements":[{"field":"ExternalAccountAllowList","description":"Cross-account principals permitted to assume roles; used for allow-listing."},{"field":"SensitiveAPIs","description":"Provider-specific list of risky APIs for scoring."},{"field":"GeoVelocityThreshold","description":"Detect impossible travel between partner and tenant actions."}],"live":true,"detection_strategies":["DET0488"],"techniques":["T1199"]},{"id":"AN1349","stix_id":"x-mitre-analytic--4766bdc0-047a-4250-93c1-6d907178620e","name":"Analytic 1349","description":"Behavioral chain: (1) third-party app or admin connects via OAuth/marketplace install; (2) high-privilege scopes granted; (3) anomalous actions (mass read/exports, admin changes).","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1349","platforms":["SaaS"],"log_source_references":[{"name":"saas:googleworkspace","channel":"OAuth2 authorization grants / Admin role assignments","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"saas-googleworkspace"},{"name":"saas:salesforce","channel":"ConnectedApp OAuth policy change / Login as user","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"saas-salesforce"}],"mutable_elements":[{"field":"ApprovedApps","description":"Catalog of sanctioned third-party apps and scopes."},{"field":"ExportVolumeThreshold","description":"Data export size/rate baselines to detect abnormal partner activity."}],"live":true,"detection_strategies":["DET0488"],"techniques":["T1199"]},{"id":"AN1350","stix_id":"x-mitre-analytic--b5985d46-1d54-4a6d-81c8-0b577b5d8d17","name":"Analytic 1350","description":"Behavioral chain: (1) delegated administration offers/relationships created or modified by partner tenants; (2) mailbox delegation/impersonation enabled; (3) follow-on access from partner IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0488#AN1350","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"Add-DelegatedAdmin, Set-PartnerOfRecord, Add-MailboxPermission, Set-OrganizationRelationship","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"m365-unified"},{"name":"azure:signinlogs","channel":"InteractiveUser, NonInteractiveUser","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"azure-signinlogs"}],"mutable_elements":[{"field":"MailboxDelegateAllowList","description":"Specific mailboxes third-parties may manage."}],"live":true,"detection_strategies":["DET0488"],"techniques":["T1199"]}],"live":true,"version":"1.0","techniques":["T1199"]}],"sigma_rules":[{"id":"fe04b26b-0ac4-45d7-9404-4b9f16a440a9","title":"Okta Session Impersonation Granted From Untrusted Domain","author":"zendannyy","status":"experimental","level":"medium","date":"2026-04-28","modified":null,"description":"Detects Okta session impersonation grant event where a user is granted the ability to impersonate another user's session.\nThis event type \"user.session.impersonation.grant\" signifies that someone has been given temporary access to act on behalf of another user account.\nThreat actors may abuse this functionality to escalate privileges, access sensitive resources, or perform unauthorized actions while appearing to be the impersonated user.\nLegitimate use cases are typically limited to Okta support scenarios or authorized administrative troubleshooting.\n","references":["https://developer.okta.com/docs/reference/system-log-query/","https://sec.okta.com/articles/2023/08/cross-tenant-impersonation-prevention-and-detection","https://support.okta.com/help/s/article/What-is-the-systemoktacom-Account-in-Syslog-Used-For"],"logsource":{"product":"okta","service":"okta"},"tags":["attack.privilege-escalation","attack.defense-impairment","attack.t1484.002","attack.initial-access","attack.t1199"],"path":"rules-placeholder/identity/okta/okta_session_impersonation_granted.yml","techniques":["T1484.002","T1199"],"cves":[]},{"id":"ff246f56-7f24-402a-baca-b86540e3925c","title":"Microsoft 365 - User Restricted from Sending Email","author":"austinsonger","status":"test","level":"medium","date":"2021-08-19","modified":"2022-10-09","description":"Detects when a Security Compliance Center reported a user who exceeded sending limits of the service policies and because of this has been restricted from sending email.","references":["https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy","https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference"],"logsource":{"product":"m365","service":"threat_management"},"tags":["attack.initial-access","attack.t1199"],"path":"rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml","techniques":["T1199"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2024-53704","state":"mapped","mapping_types":["exploitation_technique"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}