T1199 Trusted Relationship

Technique: T1199
Tactics: Initial Access
Research, 90 days: 5
KEV CVEs mapped: 1
SigmaHQ rules: 1
Elastic, Splunk: 5
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1199

MITRE description

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, [Valid Accounts](https://attack.mitre.org/techniques/T1078) used by the other party for access to internal network systems may be compromised and used.(Citation: CISA IT Service Providers) In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.(Citation: Office 365 Delegated Administration)

KEV CVEs mapped to this technique

MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.

CVE-2024-53704

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-11-03 ESET: Gorbag: Orcs at the border harvesting intelligence from Ukraine
2026-10-26 Huntress: AI, Scripts, Operator: Inside the ConnectWise Attack
2026-10-26 Arctic Wolf: Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access
2026-10-21 Microsoft Threat Intelligence: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
2026-10-15 GuidePoint GRIT: Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew

Detection coverage

SigmaHQ community rules

Microsoft 365 - User Restricted from Sending Email (core)

Elastic and Splunk rules

Entra ID Illicit Consent Grant via Registered Application (elastic)
Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource (elastic)
Entra ID OAuth Phishing via First-Party Microsoft Application (elastic)
New GitHub App Installed (elastic)
Okta Sign-In Events via Third-Party IdP (elastic)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.