Security Operations · Intermediate

Initial Access

The ATT&CK tactic (TA0001) covering techniques adversaries use to gain their first foothold in a network.

Definition

Initial access techniques include phishing, exploiting public-facing applications, external remote services such as VPN and RDP, valid accounts, drive-by compromise, supply chain compromise and trusted relationships. Identifying the initial access vector is a key goal of incident investigation.

Related terms