Home/ MITRE Matrix/ Initial Access/ T1199

T1199Trusted Relationship

T1199 — Trusted Relationship is a MITRE ATT&CK technique in the Initial Access tactic. Clankerusecase tracks 7 detection use cases covering it and 3 threat-intel articles citing it.

Initial Access

View on the matrix → Filter Detection Library MITRE official spec ↗

7Use cases

3Articles

0Sub-techniques

1Tactic

Use cases covering this technique (7)

AWS EC2 key-pair created Internal install · alerting DD [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD Github Commit Changes In Master ESCU actions · hunting P Github Commit In Develop ESCU actions · hunting P [LLM] FileBrowser reverse-proxy bypass: direct external access to exposed port 8085 Bespoke delivery · alerting DSΣPDDCS [LLM] GitHub workflow references actions-cool/issues-helper or maintain-one-comment by tag Bespoke delivery · alerting SPDD [LLM] MuddyWater SimpleHelp RMM client spawning shell or recon LOLBin Bespoke install · alerting DSΣP

Articles citing this technique (3)

crit [GHSA / CRITICAL] CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery art-299

med actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials art-472

crit Cyber fallout from the Iran war: What to have on your radar art-626