T1199
Trusted Relationship
Index entry
In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.
Telemetry needed
The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.
- AWS CloudTrail
- Entra ID audit logs (the log as a whole)
- Entra ID sign-in logs
- Google Cloud Audit Logs (the log as a whole)
- Google Workspace audit logs (the log as a whole)
- Linux audit framework (auditd)
- SYSCALL:connect SYSCALL record for connect
- SYSCALL:execve SYSCALL record for execve
- SYSCALL:openat SYSCALL record for openat
- SYSCALL:socket SYSCALL record for socket
- syslog / journald (auth, secure, messages, cron) (the log as a whole)
- Microsoft 365 Unified Audit Log
- macOS unified log (the log as a whole)
- Network flow records (Zeek conn, NetFlow, firewall flow) (the log as a whole)
- SaaS application audit logs (Slack, Salesforce, Box, Zoom, Confluence, Snowflake, ...) (the log as a whole)
- Windows Security event log
- 4624 An account was successfully logged on.
- 4648 A logon was attempted using explicit credentials.
- 4656 A handle to an object was requested.
- 4663 An attempt was made to access an object.
- 4670 Permissions on an object were changed.
- 4770 A Kerberos service ticket was renewed.
- 4771 Kerberos pre-authentication failed.
- 4776 The domain controller attempted to validate the credentials for an account.
- Sysmon