Home/ MITRE Matrix/ Initial Access/ T1199

T1199Trusted Relationship

T1199 — Trusted Relationship is a MITRE ATT&CK technique in the Initial Access tactic. Clankerusecase tracks 8 detection use cases covering it and 4 threat-intel articles citing it.

Initial Access

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (8)

AWS EC2 key-pair created Internal install · alerting DD [WEEKLY] Vendor / Third-Party OAuth App or SP Sign-in From Unbaselined Egress Followed by Bulk SaaS Object Read Internal actions · alerting DSPDD Github Commit Changes In Master ESCU actions · hunting P Github Commit In Develop ESCU actions · hunting P [LLM] FileBrowser reverse-proxy bypass: direct external access to exposed port 8085 Bespoke delivery · alerting DSΣPDDCS [LLM] GitHub workflow references actions-cool/issues-helper or maintain-one-comment by tag Bespoke delivery · alerting SPDD [LLM] Hoppscotch cross-team request injection via moveRequest GraphQL with null nextRequestID Bespoke exploit · hunting SPDD [LLM] MuddyWater SimpleHelp RMM client spawning shell or recon LOLBin Bespoke install · alerting DSΣP

Articles citing this technique (4)

crit [GHSA / CRITICAL] CVE-2026-54089: File Browser: Authentication Bypass via Proxy Auth Header Forgery art-204

med actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials art-426

high Aikido Attack finds multiple 0-days in Hoppscotch art-528

crit Cyber fallout from the Iran war: What to have on your radar art-593