MITRE ATT&CK - Técnica

T1199: Trusted Relationship

Trusted Relationship (T1199) é uma técnica catalogada no MITRE ATT&CK Enterprise usada como referência para mapear comportamento adversário em auditorias de segurança.

Técnica T1199 Enterprise ATT&CK

Contexto para AppSec

Em uma auditoria de AppSec, Trusted Relationship deve ser usada para revisar caminhos em que código, configuração, dependências ou infraestrutura podem viabilizar o comportamento descrito pela MITRE. No ATT&CK, ela aparece em Initial Access. As plataformas mapeadas pela MITRE incluem IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS e Windows. No Vigly, esse contexto ajuda a conectar evidências do repositório com priorização e remediação.

Tática/fase Initial Access
Plataformas MITRE IaaS, Identity Provider, Linux, macOS, Office Suite, SaaS, Windows

Descrição oficial original do MITRE ATT&CK

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used. In Office 365 environments, organizations may grant Microsoft partners or resellers delegated administrator permissions. By compromising a partner or reseller account, an adversary may be able to leverage existing delegated administrator relationships or send new delegated administrator offers to clients in order to gain administrative control over the victim tenant.

Ver fonte oficial no MITRE ATT&CK

Como o Vigly audita a técnica Trusted Relationship automaticamente na sua pipeline

O Vigly cruza sinais de SAST, modelagem de ameaças, regras de negócio e evidências do repositório para priorizar riscos reais antes que eles cheguem à produção.

Conhecer a plataforma