TA0001 · INITIAL ACCESS
Trusted Relationship
Adversaries may breach or otherwise leverage organizations who have access to intended victims.
Detect it with
Establish monitoring for activity conducted by second and third party providers and other trusted entities that may be leveraged as a means to gain access to the network.
Why it matters on shift
Trusted Relationship is one of the concrete ways adversaries achieve initial access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After initial access, the next tactic is usually Execution. Search your telemetry for the transition before closing the ticket.
Kill-chain context