Initial Access.

Initial Access (MITRE ATT&CK tactic TA0001) groups the techniques adversaries use to gain their first entry point into a network or system. Its nine techniques include spearphishing attachments and links (T1566), exploitation of public-facing applications (T1190), valid accounts (T1078) purchased from initial access brokers, supply-chain compromise (T1195), drive-by downloads, and abuse of trusted relationships. Initial Access is a critical inflection point: it converts external pressure into in-network presence, after which adversaries pivot to execution, persistence, and discovery.

Real campaigns show how varied the entry can be. In the MOVEit Transfer campaign of May–June 2023, the Cl0p group exploited a public-facing web app via SQL injection (CVE-2023-34362), auto-scanning the internet and compromising 1,000+ organisations in days, then deploying the LEMURLOOT web shell. Log4Shell (CVE-2021-44228) similarly turned exposed services into footholds, while the 2015 Anthem breach began with a single spearphishing email to a subsidiary before lateral movement to 78.8 million records.

flowchart LR
  ADV[Adversary] --> P[Spearphishing<br/>T1566]
  ADV --> E[Exploit public app<br/>T1190]
  ADV --> V[Valid accounts<br/>T1078]
  ADV --> S[Supply chain<br/>T1195]
  P --> FOOT[Foothold in network]
  E --> FOOT
  V --> FOOT
  S --> FOOT
  FOOT -->|TA0002+| NEXT[Execution → Persistence → Discovery]
  DEF[Defenders] -. MFA, patching, email/web filtering, EDR .-> FOOT

Defenders prioritise phishing-resistant MFA, attack-surface reduction, email and web filtering, rapid patching of internet-facing services, and EDR coverage on first-touch endpoints to detect and block these techniques.