Trusted Relationship

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security).

The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts and Private Keys used by the other party for access to internal network systems via services such as SSH External Remote Services may be compromised and used.[1]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

Establish monitoring for activity conducted by second and third party providers and other trusted entities that may be leveraged as a means to gain access to the network. Depending on the type of relationship, an adversary may have access to significant amounts of information about the target before conducting an operation, especially if the trusted relationship is based on IT services. Adversaries may be able to act quickly towards an objective, so proper monitoring for behavior related to Credential Access, Lateral Movement, and Collection will be important to detect the intrusion.

References

Attachments

ID
VT0010
MITRE ID
Sub-techniques
No sub-techniques
Tactic
Initial Access
Platforms
AWS
Azure
GCP
Linux
SaaS
Windows
macOS
Data Sources
AWS CloudTrail logs
Application logs
Authentication logs
Azure activity logs
Stackdriver logs
Third-party application logs
Version
2.0

Created: 20 December 2020

Last Modified: 27 December 2020