Other initial access techniques

In addition to the initial access techniques described previously, threat actors may use Trusted Relationship (T1199) to exploit connections between individuals, networks, or systems. In this case, depending on the specific situation, the traceback process will be a different combination of some methods described earlier. The main difference is that the source of the malicious activity will be a trusted source. This could be service providers (SPs), partners, third-party solutions used within the organization, or companies within the same holding company. For example, LAPSUS$ in certain attacks used Azure Active Directory and Okta to infiltrate the target infrastructure (https://www.techtarget.com/searchsecurity/news/252515022/Microsoft-confirms-breach-attributes-attack-to-Lapsus), and in the case of SolarWinds, threat actors used compromised Mimecast certificates to authenticate to their customers (https://www.mimecast.com/incident-report/).

Replication...