ATT&CK Initial Access Tactic: How Attackers Get In and Which Controls Stop Them

Every intrusion needs a way in, and the Initial Access tactic (TA0001) in MITRE ATT&CK is the short list of doors attackers actually use. ATT&CK v20 describes the tactic as the adversary "trying to get into your network", using entry vectors such as targeted spearphishing and exploits against public-facing web servers, and notes that some footholds, such as valid accounts and external remote services, allow continued access. This hub ranks the 22 current Initial Access techniques and sub-techniques by how often they appear in ATT&CK procedure data and in the NHI Mgmt Group breach library, sets out the detection and control priorities across the whole tactic, and links each technique guide for depth. It is written for detection engineers, security architects and identity teams deciding where the next control or analytic should go.

Key takeaways

• Credentials are the most common door in our breach data. 114 of the 250 breach analyses on nhimg.org record stolen, leaked or default credentials as an entry vector, which ATT&CK files under T1078 Valid Accounts and its sub-techniques.
• Phishing dominates the ATT&CK procedure data. The T1566 Phishing family has 270 recorded uses by groups, software and campaigns in v20, led by Spearphishing Attachment (151) and Spearphishing Link (89).
• Edge exploitation is the fastest route to many victims at once. T1190 Exploit Public-Facing Application has 77 recorded uses, more than any other single technique in the tactic, and VPN and remote access appliances recur in mass exploitation events.
• Machine identities are entry points, not only targets. Leaked API keys, OAuth tokens held by integrations and CI tokens let attackers log in as a trusted application, which ATT&CK records as Valid Accounts, Trusted Relationship or Supply Chain Compromise depending on the path.
• Three mitigations cover most of the tactic. User Account Management (M1018) and User Training (M1017) each mitigate 9 of the 22 entries and Multi-factor Authentication (M1032) mitigates 8, so identity hygiene and phishing-resistant MFA carry most of the prevention load.

What Initial Access means in practice

Initial Access is the point where the adversary moves from preparing outside your environment (see the ATT&CK Resource Development Tactic Guide) to running code or holding a session inside it. ATT&CK separates two kinds of foothold, and the difference matters for response:

• Durable footholds: a working credential, token or remote access path (T1078, T1133, T1199). The attacker can come back until the credential is revoked, so the same technique also counts as Persistence. Revoking and rotating is part of containment.
• One-shot footholds: an exploit, a malicious attachment or a drive-by page (T1190, T1566, T1189). The attacker gets code execution once and must immediately establish persistence or harvest credentials. Detection here focuses on what the exploited process does next.

Initial Access techniques rarely appear alone. They hand over to Execution (an attachment that runs a script, see the ATT&CK Execution Tactic Guide), to Persistence (a web shell or new account, see the ATT&CK Persistence Tactic) or straight to Credential Access on the edge device. For a vendor-neutral overview of entry methods outside the ATT&CK structure, see the Initial Access Techniques Guide.

Ranking the entry techniques

Two data sets were combined. The ATT&CK counts are the number of "uses" relationships from groups, software and campaigns to each technique in the Enterprise ATT&CK v20 STIX dataset (revoked and deprecated objects excluded), which approximates how often a technique appears in public threat reporting. The breach counts are the entry vectors recorded on the 250 live breach analyses in the NHI Mgmt Group library; one breach can carry several vectors, and the library is weighted towards identity and secrets incidents, so it measures what matters for identity teams rather than all intrusions.

The ranking puts Valid Accounts first even though Phishing has more recorded uses, because phishing is frequently the means and a valid account is the result: a credential phished, bought from an infostealer log or found in a public repository is then used through T1133 or a cloud login. For defenders the account is the common control point. The breach library also shows that NHI credentials are a large share of this: 54 breaches record a leaked secret such as an API key, access key or token as an entry vector. See the Leaked secret breaches analysis.

Attack chains from real cases

These cases from the breach library show how Initial Access hands over to the rest of the intrusion.

• Stolen credential, remote access without MFA (T1078 then T1133): in the Change Healthcare breach attackers logged in to a Citrix remote access portal on 12 February 2024 with a stolen employee credential; UnitedHealth's chief executive told Congress the portal did not have multifactor authentication. They moved laterally for nine days before deploying ransomware on 21 February.
• Infostealer credentials against a cloud service (T1078.004): in the Snowflake customer breaches of 2024, attackers used usernames and passwords harvested by infostealer malware against single-factor accounts with no network allow lists. Mandiant reported that at least 79.7% of the accounts used had prior credential exposure, and about 165 organisations were notified. No platform vulnerability was involved.
• Edge exploit to credential theft (T1190): in the Ivanti Connect Secure exploitation, CVE-2023-46805 and CVE-2024-21887 were chained for unauthenticated command execution on the VPN appliance. Attackers then harvested plaintext credentials from the login page, and CISA told agencies to treat stored user and service account credentials, API keys and certificates as likely compromised.
• Trusted integration tokens (T1199 with T1078.004): in the Salesloft Drift breach, OAuth tokens taken from the vendor's environment were used between 8 and 18 August 2025 to call Salesforce APIs as the trusted Drift application, with no phishing and no Salesforce flaw. Google Threat Intelligence Group cited over 700 potentially impacted organisations.
• Trojanised update (T1195.002): in the SolarWinds supply chain compromise, signed Orion builds carrying the SUNBURST backdoor shipped as normal updates from March to June 2020, and up to about 18,000 customers may have installed them.

The common thread is that the entry step looked legitimate: a valid login, a signed update, an authorised application. Detection that only looks for malware or exploit signatures misses most of these, which is why identity telemetry sits at the top of the detection priorities below.

Detection priorities across the tactic

ATT&CK v20 attaches a detection strategy with platform analytics to each technique. The table summarises the behaviour chain each strategy describes and the log sources it names, in the order a SOC should build them.

Two cross-cutting rules raise the value of everything above. First, treat non-interactive and service principal sign-ins as first-class detection data: many of the breaches in the library involved a key or token rather than a person, and those sign-ins appear in separate logs that are often not forwarded. Second, correlate the entry signal with the next step. A successful VPN login from a new country is weak on its own; the same login followed within an hour by directory enumeration is a strong lead. The VPN and Firewall Log Detection Guide covers the gateway side in detail.

Mitigation priorities

Counting the "mitigates" relationships in v20 for the 22 entries shows where one control investment covers the most of the tactic. See the ATT&CK Mitigations hub for each mitigation in full.

Where identity fits

Four of the six highest-ranked families are identity problems at heart: Valid Accounts, External Remote Services, Trusted Relationship and the token side of Supply Chain Compromise. For non-human identities the practical controls are a secrets inventory with scanning of code, CI logs and container images; short-lived, workload-bound credentials instead of static keys; IP or network restrictions on keys and integration tokens where the platform supports them; and an owner and expiry for every OAuth grant held by a third party. See the MITRE ATT&CK T1078 Valid Accounts Guide and the Third-Party Access Guide.

Implementation roadmap

1. Inventory the doors. List every internet-facing application, VPN, remote desktop gateway, SSO portal, exposed API and management interface, plus every third party and integration holding credentials or tokens into your tenants. Use external attack surface scanning to find what the CMDB misses (see the Attack Surface Management Guide).
2. Close the credential door first. Enforce MFA on all external access, phishing-resistant for privileged and remote access; remove default and unused accounts; rotate any key found in code or logs. Pilot with one user group in report-only or audit mode where the IdP offers it, then enforce; keep a documented break-glass account as the rollback path.
3. Shorten the exploit window. Track the CISA Known Exploited Vulnerabilities catalogue against your edge inventory and set a patch or mitigate target in days, not weeks, for exposed systems. Move management interfaces behind a VPN or zero trust access broker.
4. Harden email and web. Block macro-enabled and executable attachments from the internet, sandbox links, and enforce SPF, DKIM and DMARC on your own domains.
5. Govern trust relationships. Review partner and delegated admin access, OAuth application consents and cross-account roles; restrict scopes and apply conditional access to service principals where supported.
6. Build detections in priority order from the detection table, test each with a safe simulation (for example, a login from a test account in an unusual location), measure alert time, then tune.

Small and large organisations

A small organisation with one SaaS identity provider gets most of the benefit from steps 1, 2 and 4 using built-in IdP and email security features. A large or regulated organisation needs the full sequence, including a formal third-party access process, KEV-driven patch service levels and SIEM correlation between gateway, IdP and endpoint logs.

Measuring coverage

• MFA coverage: percentage of externally reachable logins (users and administrators) protected by MFA, and the share that is phishing-resistant.
• Exposed KEV time to remediate: median days from KEV listing to patch or mitigation for internet-facing assets.
• Unknown external assets: number of internet-facing services found by scanning that were not in the inventory, trending down.
• Secret exposure dwell time: hours from a secret appearing in code or logs to its revocation.
• Third-party grants with an owner and expiry: percentage of OAuth grants and partner accounts with a named owner and review date.
• Phishing report rate: share of simulated and real phishing reported by users, and the time to the first report.

Common failure patterns

• MFA everywhere except the legacy gateway: one remote access portal or old VPN profile left on passwords alone is enough, as Change Healthcare showed.
• Patching the appliance but not resetting what it held: an exploited edge device may have exposed every credential and certificate it stored; patching alone does not remove that access.
• Credentials that never expire: infostealer logs stay useful for years when passwords and keys are not rotated, which is what Mandiant found in the Snowflake campaign.
• Integrations outside identity governance: OAuth tokens and service principals held by vendors are not reviewed with user access, so a vendor breach becomes your breach.
• Signature-only detection: a valid login, a signed update or a trusted application does not match any malware rule, so behaviour and identity analytics are required.

Every technique in the tactic

All 22 current Initial Access techniques and sub-techniques in Enterprise ATT&CK v20, with the recorded use count. Technique guides are linked where they exist; sub-techniques are covered on their parent's guide.

Framework mapping

Practitioner checklist

• Keep a complete inventory of internet-facing services and third-party access paths, reconciled with external scanning.
• Enforce MFA on every external login, phishing-resistant for administrators and remote access gateways.
• Remove default, unused and orphaned accounts and keys; rotate any secret found in code, images or logs.
• Patch or mitigate KEV-listed flaws on exposed systems within a defined number of days.
• After any edge device compromise, reset every credential, key and certificate it stored.
• Forward IdP interactive, non-interactive and service principal sign-in logs to the SIEM.
• Alert on web servers and appliances spawning shells or making new outbound connections.
• Review OAuth grants, partner and delegated admin access with an owner and expiry for each.
• Block high-risk attachment types and sandbox links at the mail gateway.

Standards and references

• MITRE ATT&CK: Initial Access (TA0001)
• MITRE ATT&CK: Valid Accounts (T1078)
• MITRE ATT&CK: Phishing (T1566)
• MITRE ATT&CK: Exploit Public-Facing Application (T1190)
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-53 Rev. 5
• CIS: CIS Controls v8.1

Related NHI Mgmt Group resources: MITRE ATT&CK Guide for Defenders · Top 10 Ransomware Initial Access Vectors · Initial Access Brokers Guide · Phishing-Resistant MFA Guide · ATT&CK Credential Access Tactic Guide