Detect Trusted Relationship in Sumo Logic CSE
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third-party relationships abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. These relationships include IT services contractors, managed security providers, and infrastructure contractors. In Office 365 and Azure AD environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.
MITRE ATT&CK
- Tactic
- Initial Access
- Technique
- T1199 Trusted Relationship
- Canonical reference
- https://attack.mitre.org/techniques/T1199/
Sumo Detection Query
(_sourceCategory=*o365* OR _sourceCategory=*azure/audit* OR _sourceCategory=*windows/security*)
| parse "\"Operation\":\"*\"" as Operation nodrop
| parse "\"UserId\":\"*\"" as ActorUPN nodrop
| parse "\"ClientIP\":\"*\"" as SourceIP nodrop
| parse "\"UserType\":*," as UserType nodrop
| parse "\"ResultStatus\":\"*\"" as ResultStatus nodrop
| parse "EventCode=*" as EventCode nodrop
| parse "LogonType=*" as LogonType nodrop
| parse "TargetUserName=*" as TargetUserName nodrop
| parse "SourceNetworkAddress=*" as SourceNetworkAddress nodrop
| where (Operation in (
"Add delegated permission grant",
"Add partner to cross-tenant access setting",
"Add policy to cross-tenant access setting",
"Set partner information",
"Add member to role",
"Add app role assignment to service principal",
"Add service principal"
))
OR (EventCode = "4624" AND LogonType = "3")
OR (UserType = "4" AND Operation in ("UserLoggedIn", "UserLoginFailed"))
| eval detection_type = if(
Operation = "Add delegated permission grant"
OR Operation contains "cross-tenant"
OR Operation contains "partner"
OR Operation = "Add app role assignment to service principal"
OR Operation = "Add service principal",
"DelegatedAdminGrant",
if(Operation = "Add member to role",
"PrivilegedRoleGrant",
if(EventCode = "4624",
"ExternalServiceAccountLogon",
if(UserType = "4",
"ExternalUserAccess",
"Other"))))
| where detection_type != "Other"
| eval actor = if(!isNull(ActorUPN) AND ActorUPN != "", ActorUPN,
if(!isNull(TargetUserName) AND TargetUserName != "", TargetUserName, "unknown"))
| eval src_ip = if(!isNull(SourceIP) AND SourceIP != "", SourceIP,
if(!isNull(SourceNetworkAddress) AND SourceNetworkAddress != "", SourceNetworkAddress, "unknown"))
| where detection_type != "ExternalServiceAccountLogon"
OR (
!matches(src_ip, "10\..*")
AND !matches(src_ip, "192\.168\..*")
AND !matches(src_ip, "172\.(1[6-9]|2[0-9]|3[01])\..*")
AND src_ip != "127.0.0.1"
AND src_ip != "::1"
AND src_ip != "unknown"
)
| eval suspicion_score =
(if(detection_type = "DelegatedAdminGrant", 3, 0))
+ (if(detection_type = "PrivilegedRoleGrant", 3, 0))
+ (if(detection_type = "ExternalUserAccess", 1, 0))
+ (if(detection_type = "ExternalServiceAccountLogon", 2, 0))
+ (if(matches(actor, "(?i).*admin.*|.*global.*|.*privileged.*"), 1, 0))
+ (if(ResultStatus = "Failed" OR ResultStatus = "Failure", 1, 0))
| where suspicion_score > 0
| table _messageTime, detection_type, Operation, actor, src_ip, ResultStatus, suspicion_score
| sort by suspicion_score desc, _messageTime descSumo Logic detection for T1199 Trusted Relationship abuse. Parses O365 management activity, Azure AD audit, and Windows Security log sources to identify delegated admin grant operations, privileged role assignments to external accounts, O365 UserType=4 external user sign-ins, and external service account network logons (EventID 4624 LogonType 3 from non-RFC1918 IPs). Applies a weighted suspicion score (max score for delegated grants and role assignments) to surface the highest-confidence events first.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate IT vendor onboarding where MSPs are granted delegated admin access via formal change management — these will score high (3) but represent authorized activity
- Cloud-hosted automation agents (Azure DevOps pipelines, Terraform Cloud runners, Datadog agents) using service-named accounts that authenticate from non-RFC1918 public IPs
- External auditors or penetration testers operating under a signed SOW whose temporary guest accounts are classified as UserType=4 and generate O365 access events during the engagement window
Other platforms for T1199
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate Delegated Admin Permission Grant via Azure AD PowerShell
Expected signal: Azure AD AuditLogs: OperationName 'Add delegated permission grant', Result 'success', InitiatedBy.user.userPrincipalName = executing account, TargetResources[0].displayName = 'Microsoft Graph'. Visible in Microsoft 365 compliance portal under Audit search with Activity = 'Add delegated permission grant'.
- Test 2Assign Privileged Role to External Guest Account Simulating MSP Onboarding
Expected signal: Azure AD AuditLogs: OperationName 'Add member to role', Result 'success', TargetResources[1].displayName = 'Global Reader', TargetResources[0].userPrincipalName contains '#EXT#'. Also generates 'Invite external user' event. Both visible in AuditLogs table within 5-10 minutes.
- Test 3Simulate MSP Network Logon from External IP Using Service Account
Expected signal: Windows Security Event ID 4624: LogonType=3 (Network), TargetUserName='svc_msp_test', SourceNetworkAddress=127.0.0.1. Security Event ID 4672 if the account has elevated privileges. Visible in Windows Event Viewer under Security log within seconds of execution.
- Test 4Create New Service Principal and Grant API Permissions Simulating Post-Access Backdoor
Expected signal: Azure AD AuditLogs: OperationName 'Add application', Result 'success', TargetResources[0].displayName = 'df00tech-detection-test-app'. Followed by OperationName 'Update application' with ModifiedProperties showing RequiredResourceAccess including Mail.Read scope. Both events include InitiatedBy.user.userPrincipalName of the executing account.
References (9)
- https://attack.mitre.org/techniques/T1199/
- https://us-cert.cisa.gov/APTs-Targeting-IT-Service-Provider-Customers
- https://support.microsoft.com/en-us/topic/partners-offer-delegated-administration-26530dc0-ebba-415b-86b1-b55bc06b073e
- https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/
- https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
- https://www.secureworks.com/research/revil-sodinokibi-ransomware
- https://learn.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities
- https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1199/T1199.md
Unlock Pro Content
Get the full detection package for T1199 including response playbook, investigation guide, and atomic red team tests.