ATT&CK technique
View on MITRE ATT&CK →
T1199
Trusted Relationship
Initial Access
7 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Entra ID OAuth Authorization Code Grant for Unusual User, App, and Resource | production | 2026-09-18 |
| elastic | New GitHub App Installed | production | 2026-09-18 |
| elastic | Okta Sign-In Events via Third-Party IdP | production | 2026-09-18 |
| elastic | Entra ID Illicit Consent Grant via Registered Application | production | 2026-09-18 |
| elastic | Entra ID OAuth Phishing via First-Party Microsoft Application | production | 2026-09-18 |
| sigma | Microsoft 365 - User Restricted from Sending Email | test | 2022-10-09 |
| sentinel | Anomalous login followed by Teams action | Scheduled | — |