Initial Access

Logging in with legitimate stolen credentials — the quietest way in and the hardest to distinguish from normal work.

Detect it with
Impossible travel, first-time ASN or country for the user, MFA fatigue patterns, logins outside the user's baseline hours.

Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.

Detect it with
Monitor file access on removable media. Detect processes that execute from removable media after it is mounted or when initiated by a user.

VPN, RDP gateways, Citrix, and VDI accessed directly with valid or brute-forced credentials.

Detect it with
VPN logins from residential proxy or VPS ranges; RDP exposed to the internet at all is a finding on its own.

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

Detect it with
Firewalls and proxies can inspect URLs for potentially known-bad domains or parameters.

Abusing a vulnerability in an internet-exposed web app, VPN appliance, or file transfer product.

Detect it with
WAF blocks followed by a 200; a web server process spawning a shell (w3wp.exe or httpd launching cmd.exe / bash).

Trojanised software updates, poisoned dependencies, or compromised managed service providers.

Detect it with
Baseline what your update processes normally do, then alert when a signed updater deviates — new child processes, new destinations.

Adversaries may breach or otherwise leverage organizations who have access to intended victims.

Detect it with
Establish monitoring for activity conducted by second and third party providers and other trusted entities that may be leveraged as a means to gain access to the network.

Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e.

Detect it with
Asset management systems may help with the detection of computer systems or network devices that should not exist on a network. Endpoint sensors may be able to detect the addition of hardware via USB, Thunderbolt, and other external device communication ports.

Attachments, links, or service-based delivery aimed at getting execution or credentials from a user.

Detect it with
Mail gateway detonation verdicts, user-reported phish queue, first-time-seen sender plus attachment execution on the endpoint.

Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may gain initial access to target systems by connecting to wireless networks.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.