信任关系滥用是指攻击者通过入侵或操纵目标企业信任的第三方实体（如IT服务商、云合作伙伴），利用其合法访问权限实施网络渗透的技术。许多组织在业务合作过程中，会授予外部第三方访问权限，如IT服务供应商、安全管理公司、基础设施承包商等。这些第三方访问通常是为了便于对企业系统或云环境进行维护管理，因此，这些信任关系可能没有受到与内部系统同等严格的安全审查，从而成为攻击者入侵的薄弱环节。攻击者通过攻击或劫持这些第三方提供者的访问权限，获得对目标网络或云环境的控制权。
攻击者利用第三方信任关系访问的方式通常比较隐蔽，因其访问行为看似合法，防御者可能难以直接识别恶意行为。这种技术绕过了传统边界防御机制，直接借助已授权的访问通道开展攻击活动。
防御措施主要包括建立第三方活动监控体系、实施最小特权原则的跨域访问控制，以及加强联合身份认证的异常检测能力。匿迹技术的演进导致传统基于权限变更监控和日志审计的防御体系面临挑战，防御方需构建供应链完整性验证机制、实施跨域身份联邦的异常行为分析，并引入云服务配置的自动化合规检查，以识别隐蔽的信任关系滥用行为。
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ✅ |
| 数据遮蔽 | ❌ |
| 时空释痕 | ✅ |
攻击者通过盗用合法数字证书、伪造标准化协议数据包等手段，使恶意活动在数字身份、通信协议等维度与正常业务交互完全一致。例如利用供应链服务商签发的代码签名证书赋予恶意软件合法身份，或严格遵循SCIM协议格式构造虚假用户同步请求，使得攻击流量具备表面合规性。
攻击者利用第三方服务商特权账号的合法操作权限，将恶意行为融入日常运维工作流。例如通过被控的IT外包商管理终端执行横向移动，利用服务商已有的数据导出权限实施信息窃取。此类活动因使用合法凭证且操作模式符合历史基线，传统基于权限异常分析的检测手段难以识别。
通过将攻击链拆解为多个低频率、长周期的操作步骤，并利用全球分布的云服务节点实施权限维持。例如跨时区调度第三方管理任务、利用云函数的定时触发器执行恶意代码，使得攻击特征分散在数周甚至数月的合法业务操作中，破坏防御系统的时序关联分析能力。
| ID | Name | Description |
|---|---|---|
| G0007 | APT28 |
Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.[1] |
| G0016 | APT29 |
APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.[2] |
| G0115 | GOLD SOUTHFIELD |
GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.[3] |
| G1004 | LAPSUS$ |
LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.[4] |
| G0045 | menuPass |
menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.[5][6][7][8][9] |
| G1005 | POLONIUM |
POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.[10] |
| G1039 | RedCurl |
RedCurl has gained access to a contractor to pivot to the victim’s infrastructure.[11] |
| G0034 | Sandworm Team |
Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.[12] Additionally, Sandworm Team has accessed Internet service providers and telecommunication entities that provide mobile connectivity.[13] |
| C0024 | SolarWinds Compromise |
During the SolarWinds Compromise, APT29 gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.[14][15] |
| G0027 | Threat Group-3390 |
Threat Group-3390 has compromised third party service providers to gain access to victim's environments.[16] |
| ID | Mitigation | Description |
|---|---|---|
| M1032 | Multi-factor Authentication |
Require MFA for all delegated administrator accounts.[17] |
| M1030 | Network Segmentation |
Network segmentation can be used to isolate infrastructure components that do not require broad network access. |
| M1018 | User Account Management |
Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary. In Office 365 environments, partner relationships and roles can be viewed under the "Partner Relationships" page.[18] |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0015 | Application Log | Application Log Content |
Configuration management databases (CMDB) and other asset management systems may help with the detection of computer systems or network devices that should not exist on a network. Monitor logs for unexpected actions taken by any delegated administrator accounts.[17] |
| DS0028 | Logon Session | Logon Session Creation |
Monitor for newly constructed logon behavior that may breach or otherwise leverage organizations who have access to intended victims. |
| Logon Session Metadata |
Correlate other security systems with login information (e.g., a user has an active login session but has not entered the building or does not have VPN access). |
||
| DS0029 | Network Traffic | Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure) from a trusted entity. Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |