Detect Trusted Relationship in Google Chronicle
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third-party relationships abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. These relationships include IT services contractors, managed security providers, and infrastructure contractors. In Office 365 and Azure AD environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1199 Trusted Relationship
- Canonical reference
- https://attack.mitre.org/techniques/T1199/
YARA-L Detection Query
rule T1199_trusted_relationship_abuse {
meta:
author = "Argus Detection Engineering"
description = "Detects trusted relationship abuse via Azure AD delegated admin grants, cross-tenant access policy changes, and privileged role grants to external or guest accounts"
mitre_attack_tactic = "Initial Access"
mitre_attack_technique = "T1199"
mitre_attack_url = "https://attack.mitre.org/techniques/T1199/"
severity = "HIGH"
confidence = "MEDIUM"
version = "1.0"
events:
$e.metadata.product_name = /(?i)(Azure Active Directory|Office 365|Microsoft 365)/
(
(
// Arm 1: Delegated admin grants and partner/cross-tenant configuration changes
$e.metadata.event_type = "USER_RESOURCE_CREATION" and
(
$e.target.resource.name = /(?i)(delegated.permission|cross.?tenant|partner.access|service.principal)/ or
$e.metadata.description = /(?i)(delegated permission|cross.tenant|partner|role.assignment)/
)
) or
(
// Arm 2: Privileged group membership granted to external or guest accounts
$e.metadata.event_type = "GROUP_MODIFICATION" and
$e.target.group.group_display_name = /(?i)(Global Admin|Privileged Role|Exchange Admin|SharePoint Admin|Security Admin|Helpdesk Admin|User Admin)/ and
(
$e.target.user.email_addresses[0] = /#EXT#/ or
$e.target.user.userid = /#EXT#/ or
$e.target.user.user_display_name = /(?i)(msp|vendor|partner|managed.service|contractor)/
)
) or
(
// Arm 3: Cross-tenant or B2B user sign-in to sensitive Microsoft 365 workloads
$e.metadata.event_type = "USER_LOGIN" and
$e.target.resource.name = /(?i)(Exchange Online|SharePoint Online|Microsoft Teams|Security Center|Compliance Center|Microsoft Graph|Azure Active Directory)/ and
(
$e.extensions.auth.auth_details = /(?i)(cross.?tenant|B2B|guest|external|inbound)/ or
$e.principal.user.email_addresses[0] = /#EXT#/
) and
$e.security_result.action = "ALLOW"
)
)
condition:
$e
}Chronicle YARA-L 2.0 rule detecting T1199 Trusted Relationship abuse using UDM-normalized Azure AD and Office 365 events. Three detection arms: (1) USER_RESOURCE_CREATION events matching delegated permission grants and cross-tenant access policy changes via resource name and description regex, (2) GROUP_MODIFICATION events assigning external/guest accounts (#EXT# pattern or vendor naming) to privileged admin groups, and (3) USER_LOGIN events where cross-tenant or B2B authentication context is present and the target resource is a high-value Microsoft 365 workload. All arms match on product_name to scope to Microsoft cloud identity events.
Data Sources
Required Tables
False Positives & Tuning
- Authorized Microsoft Partner Center resellers creating or updating delegated admin relationships as part of contractual Tier 1/Tier 2 support delivery — fires on both initial grant and any periodic renewal
- B2B collaboration guests from established partner organizations accessing shared SharePoint document libraries or Teams project workspaces as part of ongoing joint ventures or co-development programs
- Identity governance workflows that periodically re-assign privileged roles to external security or audit accounts during compliance review cycles, generating GROUP_MODIFICATION events in bursts
Other platforms for T1199
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Delegated Admin Permission Grant via Azure AD PowerShell
Expected signal: Azure AD AuditLogs: OperationName 'Add delegated permission grant', Result 'success', InitiatedBy.user.userPrincipalName = executing account, TargetResources[0].displayName = 'Microsoft Graph'. Visible in Microsoft 365 compliance portal under Audit search with Activity = 'Add delegated permission grant'.
- Test 2Assign Privileged Role to External Guest Account Simulating MSP Onboarding
Expected signal: Azure AD AuditLogs: OperationName 'Add member to role', Result 'success', TargetResources[1].displayName = 'Global Reader', TargetResources[0].userPrincipalName contains '#EXT#'. Also generates 'Invite external user' event. Both visible in AuditLogs table within 5-10 minutes.
- Test 3Simulate MSP Network Logon from External IP Using Service Account
Expected signal: Windows Security Event ID 4624: LogonType=3 (Network), TargetUserName='svc_msp_test', SourceNetworkAddress=127.0.0.1. Security Event ID 4672 if the account has elevated privileges. Visible in Windows Event Viewer under Security log within seconds of execution.
- Test 4Create New Service Principal and Grant API Permissions Simulating Post-Access Backdoor
Expected signal: Azure AD AuditLogs: OperationName 'Add application', Result 'success', TargetResources[0].displayName = 'df00tech-detection-test-app'. Followed by OperationName 'Update application' with ModifiedProperties showing RequiredResourceAccess including Mail.Read scope. Both events include InitiatedBy.user.userPrincipalName of the executing account.
References (9)
- https://attack.mitre.org/techniques/T1199/
- https://us-cert.cisa.gov/APTs-Targeting-IT-Service-Provider-Customers
- https://support.microsoft.com/en-us/topic/partners-offer-delegated-administration-26530dc0-ebba-415b-86b1-b55bc06b073e
- https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
- https://www.secureworks.com/research/revil-sodinokibi-ransomware
- https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities
- https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1199/T1199.md
Unlock Pro Content
Get the full detection package for T1199 including response playbook, investigation guide, and atomic red team tests.