Skip to content

Trusted Relationship

Technique · ATTACK:enterprise:T1199

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1199",
  "title": "Trusted Relationship",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1199",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--9fa07bef-9c81-421e-a8e5-ad4366c5a925",
  "external_id": "T1199",
  "domain": "enterprise",
  "created": "2018-04-18T17:59:24.739Z",
  "modified": "2026-05-12T15:12:00.706Z",
  "version": "2.4",
  "aliases": [

  ],
  "tactics": [
    "initial-access"
  ],
  "source_references": [
    {
      "source_name": "CISA IT Service Providers",
      "url": "https://us-cert.cisa.gov/APTs-Targeting-IT-Service-Provider-Customers"
    },
    {
      "source_name": "Office 365 Delegated Administration",
      "url": "https://support.microsoft.com/en-us/topic/partners-offer-delegated-administration-26530dc0-ebba-415b-86b1-b55bc06b073e?ui=en-us&rs=en-us&ad=us"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0115 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1567be6a-0231-4605-b92b-ae1bc5e1bb4e

Secureworks REvil September 2019

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1cfd8afe-772b-45ee-9c3d-58188b709bf4

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--565d2d07-0e2e-44e5-bc37-5a64e49394ee

DOJ GRU Indictment Jul 2018

ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--690c6d2a-3e02-4eb9-b835-079c50c64adf

Profero APT27 December 2020

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--884c3843-5065-4919-ad6e-0f77130b4d36

Microsoft Nobelium Admin Privileges

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9528abfe-4897-4171-8e01-a0ceeb376a9a

mandiant_apt44_unearthing_sandworm · US District Court Indictment GRU Unit 74455 October 2020

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--99a96ac0-c93d-488b-8439-04d97716682c

FireEye APT10 April 2017 · PWC Cloud Hopper Technical Annex April 2017 · Symantec Cicada November 2020 · DOJ APT10 Dec 2018 · District Court of NY APT10 Indictment December 2018

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a246ff9a-6414-461f-b392-ac37bc3716c0

CrowdStrike StellarParticle January 2022 · Cybersecurity Advisory SVR TTP May 2021

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a42398e2-3daa-452a-80f8-f06660328f18

Office 365 Partner Relationships

ATTACK:enterprise:G1039 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4ec9b64-726b-4f6e-9115-98653d2bf8d4

therecord_redcurl

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ae93611e-8520-4c12-8fbe-7437f33a4092

MSTIC Nobelium Oct 2021

ATTACK:enterprise:G1005 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0e3680e-6099-4f33-a45e-5e938a7e7085

Microsoft POLONIUM June 2022

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca446484-9d2d-464d-bb17-88914d6f9b36

Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:G1004 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2e2fb8d-6b89-4d49-bea9-cca54ae3e56d

MSTIC DEV-0537 Mar 2022

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e59b9a1d-51cb-4ad8-b363-23ac4a7535ec

Check Point VOID MANTICORE Handala Hack March 2026

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef3683c7-1514-4fa3-9c2d-477fb945982a

Talos Sea Turtle 2019

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0e9a1f7-8600-4558-9d2e-91126c42b126

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1199

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f3f0d678-c173-4817-8f61-803d7a8cc2e7

CISA_AA25-239ASaltTyphoon_Sept2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.