Trusted Relationship, Technique T1199 - Enterprise | MITRE ATT&CK®

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.[1] In Office 365 environments, organizations may grant Microsoft partners or resellers dele

Trusted Relationship, Technique T1199 - Enterprise | MITRE ATT&CK® ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0 . Home Techniques Enterprise Trusted Relationship Trusted Relationship Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to a

related reading

• External Remote Services, Technique T1133 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Account Manipulation, Technique T1098 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Entra ID service principals in business email compromise schemes | Red Canaryredcanary.com
• PerfectData Software Abuse and Account Takeover Risksdarktrace.com
• Initial Access, Tactic TA0001 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Responding to Adversary in the Middle attacksinvictus-ir.com
• Threat actors misuse OAuth applications to automate financially driven attacksmicrosoft.com
• D3FEND Matrix | MITRE D3FEND™d3fend.mitre.org
• Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Cloud coverage: Detecting an email payroll diversion attackredcanary.com