MITRE ATT&CK CoA - T1199 - Trusted Relationship

This playbook Remediates the Trusted Relationship technique using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team. ***Disclaimer: This playbook does not simulate an attack using the specified technique, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs). Techniques Handled: - T1199: Trusted Relationship Kill Chain phases: - Initial Access MITRE ATT&CK Description: Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network. Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used. Possible playbook uses: - The playbook can be used independently to handle and remediate the specific technique. - The playbook can be used as a part of the “Courses of Action - Defense Evasion” playbook to remediate techniques based on the kill chain phase. - The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, which can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.

MITRE ATT&CK - Courses of Action · 5 tasks · 0 inputs · 1 output

Details

ID	`MITRE ATT&CK CoA - T1199 - Trusted Relationship`
From Version	6.5.0
Tasks	5

README

This playbook Remediates the Trusted Relationship technique using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team.

***Disclaimer: This playbook does not simulate an attack using the specified technique, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).
Techniques Handled:

T1199: Trusted Relationship

Kill Chain phases:

Initial Access

MITRE ATT&CK Description:

Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider’s access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.

Possible playbook uses:

The playbook can be used independently to handle and remediate the specific technique.
The playbook can be used as a part of the “Courses of Action - Defense Evasion” playbook to remediate techniques based on the kill chain phase.
The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, which can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

Set
SetGridField

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

Path	Description	Type
Handled.Techniques	The techniques handled in this playbook	string

Playbook Image

MITRE ATT&CK CoA - T1199 - Trusted Relationship

Outputs

Handled.Techniques — The techniques handled in this playbook

Flowchart

Source

playbook-CoA_-_T1199_-_Trusted_Relationship.yml

Download History Raw

description: "This playbook Remediates the Trusted Relationship technique using intelligence-driven Courses of Action (COA) defined by Palo Alto Networks Unit 42 team.\n \n***Disclaimer: This playbook does not simulate an attack using the specified technique, but follows the steps to remediation as defined by Palo Alto Networks Unit 42 team’s Actionable Threat Objects and Mitigations (ATOMs).\nTechniques Handled:\n- T1199: Trusted Relationship\n\nKill Chain phases:\n- Initial Access\n\nMITRE ATT&CK Description:\n\nAdversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.\n\nOrganizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments. Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors (e.g. HVAC, elevators, physical security). The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise. As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.\n\nPossible playbook uses:\n- The playbook can be used independently to handle and remediate the specific technique.\n- The playbook can be used as a part of the “Courses of Action - Defense Evasion” playbook to remediate techniques based on the kill chain phase.\n- The playbook can be used as a part of the “MITRE ATT&CK - Courses of Action” playbook, which can be triggered by different sources and accepts the technique MITRE ATT&CK ID as an input."
id: MITRE ATT&CK CoA - T1199 - Trusted Relationship
inputs: []
name: MITRE ATT&CK CoA - T1199 - Trusted Relationship
outputs:
- contextPath: Handled.Techniques
  description: The techniques handled in this playbook
  type: string
starttaskid: "0"
tasks:
  "0":
    id: "0"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "10"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: 79d85b74-71b3-4411-8667-26488766aa0f
      iscommand: false
      name: ""
      version: -1
      description: ''
    taskid: 79d85b74-71b3-4411-8667-26488766aa0f
    timertriggers: []
    type: start
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
  "9":
    id: "9"
    ignoreworker: false
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      id: cc21508b-d559-4c3c-8f6e-6fb3b996c6d1
      iscommand: false
      name: Done
      type: title
      version: -1
      description: ''
    taskid: cc21508b-d559-4c3c-8f6e-6fb3b996c6d1
    timertriggers: []
    type: title
    view: |-
      {
        "position": {
          "x": 50,
          "y": 755
        }
      }
  "10":
    id: "10"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "14"
    note: false
    quietmode: 0
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Manual - Configure Interfaces and Zones segmentation in PAN-OS.
      id: a60fcf96-c75d-4957-833e-0cdb291f5816
      iscommand: false
      name: Manual - Configure Interfaces and Zones segmentation in NGFW
      type: regular
      version: -1
    taskid: a60fcf96-c75d-4957-833e-0cdb291f5816
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
  "14":
    id: "14"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "15"
    note: false
    quietmode: 0
    scriptarguments:
      append:
        simple: "true"
      key:
        simple: Handled.Techniques
      stringify: {}
      value:
        simple: T1199
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Set a value in context under the key you entered.
      id: 2740c9ae-92b0-4d76-8e08-ddc8f78f7247
      iscommand: false
      name: Set technique handled
      script: Set
      type: regular
      version: -1
    taskid: 2740c9ae-92b0-4d76-8e08-ddc8f78f7247
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
  "15":
    continueonerror: true
    id: "15"
    ignoreworker: false
    nexttasks:
      '#none#':
      - "9"
    note: false
    quietmode: 0
    scriptarguments:
      columns:
        simple: technique
      context_path:
        simple: Handled.Techniques
      grid_id:
        simple: handledtechniques
      keys: {}
      overwrite: {}
      sort_by: {}
      unpack_nested_elements: {}
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Creates a Grid table from items or key-value pairs.
      id: 5414651a-73cb-441e-8575-a77ac7f4aece
      iscommand: false
      name: Set grid field
      script: SetGridField
      type: regular
      version: -1
    taskid: 5414651a-73cb-441e-8575-a77ac7f4aece
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 50,
          "y": 560
        }
      }
version: -1
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 770,
        "width": 380,
        "x": 50,
        "y": 50
      }
    }
  }
tests:
- No tests (auto formatted)
fromversion: 6.5.0