Cyber Wiki Learning Path
MITRE ATT&CK®: Initial Access
Explore all active Enterprise ATT&CK v19.2 techniques and sub-techniques associated with the Initial Access objective, with defensive explanations and linked BMC learning resources.
Recommended Sequence
22 connected entries
Cloud Accounts (T1078.004)
Cloud Accounts (T1078.004) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
ATT&CK sub-technique profile · AdvancedCompromise Hardware Supply Chain (T1195.003)
Compromise Hardware Supply Chain (T1195.003) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
ATT&CK sub-technique profile · AdvancedCompromise Software Dependencies and Development Tools (T1195.001)
Compromise Software Dependencies and Development Tools (T1195.001) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
ATT&CK sub-technique profile · AdvancedCompromise Software Supply Chain (T1195.002)
Compromise Software Supply Chain (T1195.002) is an Enterprise ATT&CK sub-technique under Supply Chain Compromise. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
ATT&CK technique profile · IntermediateContent Injection (T1659)
Content Injection (T1659) is an Enterprise ATT&CK technique associated with Initial Access, Command and Control. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedDefault Accounts (T1078.001)
Default Accounts (T1078.001) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
ATT&CK sub-technique profile · AdvancedDomain Accounts (T1078.002)
Domain Accounts (T1078.002) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
ATT&CK technique profile · IntermediateDrive-by Compromise (T1189)
A user is exposed to malicious web content that exploits a browser or convinces the user to retrieve and run harmful content, creating an entry path through normal browsing.
ATT&CK technique profile · IntermediateExploit Public-Facing Application (T1190)
An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.
ATT&CK technique profile · IntermediateExternal Remote Services (T1133)
An adversary uses externally reachable VPN, remote desktop, SSH, virtual application, management, or other remote-access services to enter or return to an environment.
ATT&CK technique profile · IntermediateHardware Additions (T1200)
Hardware Additions (T1200) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedLocal Accounts (T1078.003)
Local Accounts (T1078.003) is an Enterprise ATT&CK sub-technique under Valid Accounts. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Stealth, Persistence, Privilege Escalation, Initial Access context.
ATT&CK technique profile · IntermediatePhishing (T1566)
Phishing (T1566) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateReplication Through Removable Media (T1091)
Replication Through Removable Media (T1091) is an Enterprise ATT&CK technique associated with Lateral Movement, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK sub-technique profile · AdvancedSpearphishing Attachment (T1566.001)
Spearphishing Attachment (T1566.001) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
ATT&CK sub-technique profile · AdvancedSpearphishing Link (T1566.002)
Spearphishing Link (T1566.002) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
ATT&CK sub-technique profile · AdvancedSpearphishing Voice (T1566.004)
Spearphishing Voice (T1566.004) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
ATT&CK sub-technique profile · AdvancedSpearphishing via Service (T1566.003)
Spearphishing via Service (T1566.003) is an Enterprise ATT&CK sub-technique under Phishing. This Bare Metal Cyber profile explains how defenders can recognize, investigate, limit, and safely study the behavior within the Initial Access context.
ATT&CK technique profile · IntermediateSupply Chain Compromise (T1195)
Supply Chain Compromise (T1195) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateTrusted Relationship (T1199)
An adversary abuses a supplier, partner, managed service, federation, software, or other trusted relationship to reach the target environment.
ATT&CK technique profile · IntermediateValid Accounts (T1078)
Valid Accounts (T1078) is an Enterprise ATT&CK technique associated with Stealth, Persistence, Privilege Escalation, Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.
ATT&CK technique profile · IntermediateWi-Fi Networks (T1669)
Wi-Fi Networks (T1669) is an Enterprise ATT&CK technique associated with Initial Access. This Bare Metal Cyber profile explains the behavior in plain language and focuses on evidence, detection, defensive design, response, and safe learning.