Threadlinqs IntelligenceStart free

ATT&CK techniqueInitial Access

T1199 Trusted Relationship

Initial AccessEnterprise

As of 2026-10-05, T1199 (Trusted Relationship) appears in 319 tracked threats, first reported 2026-01-27 and most recently 2026-10-02, with linked actors including TeamPCP, ShinyHunters, APT38; it most often appears alongside T1005 (Data from Local System).

Tracked threats
319107 critical, 166 high, 37 medium, 3 low
First seen
2026-01-27
Last seen
2026-10-02
Threat actors
107In the threats using it
Detection rules
366Blue tier and above

Data as of:

Activity timeline

T1199 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 128 reports, and 319 of the 319 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1199 Trusted Relationship is catalogued by MITRE ATT&CK under the Initial Access tactic in the Enterprise matrix. Threadlinqs maps 319 of 2623 tracked threats (12.2%) to it; by severity that is 107 critical, 166 high, 37 medium, 3 low.

Threats that use T1199 most often also use T1005 Data from Local System (158 threats), T1027 Obfuscated Files or Information (158 threats), T1059 Command and Scripting Interpreter (151 threats), T1567 Exfiltration Over Web Service (136 threats), T1041 Exfiltration Over C2 Channel (134 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

107 tracked threat actors appear in the threats that use T1199; the most frequent are TeamPCP (24), ShinyHunters (17), APT38 (8), Scattered LAPSUS$ Hunters (8), Scattered Spider (8).

Mitigations

MITRE ATT&CK lists 3 mitigations for T1199.

Data sources

Telemetry that can reveal T1199, per MITRE ATT&CK.

  • Application Log — Application Log Content
  • Logon Session — Logon Session Creation, Logon Session Metadata
  • Network Traffic — Network Traffic Content

Threat actors using it

Tracked threats

The 30 most recent of 319 tracked threats that use T1199.

Detection coverage

Threadlinqs maintains 366 detection rules mapped to T1199 (SPL 131, KQL 120, Sigma 115). Rule content is available to Blue tier accounts and above; this page shows counts only.

366 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans