Top 10 Attack Techniques Seen in Breaches

Most breaches are built from the same short list of techniques, so a defender who detects and blocks those few well stops more intrusions than one who spreads effort across hundreds of ATT&CK entries. This page ranks the ten techniques that appear again and again across incident response reports and our own breach analyses, followed from first access to final impact, and maps each one to MITRE ATT&CK v20. For each technique it explains how it shows up, what to log and alert on, and the control that breaks it. It is for security operations, detection engineering and security leaders deciding where detection and hardening effort should go first. The ranking is NHI Mgmt Group's editorial view, informed by the public reports cited below; for how to use ATT&CK itself see the MITRE ATT&CK Guide for Defenders.

Key takeaways

• Getting in is mostly exploits and logins: Verizon's 2026 DBIR, based on 2025 data, reports that 31% of breaches started with vulnerability exploitation, now ahead of stolen credentials; Sophos found compromised credentials were the root cause in 42% of its 2025 cases.
• Attackers log in rather than break in: valid accounts (T1078) cover on-premises, cloud and machine identities, and they defeat controls that look only for malware.
• Built-in tools do most of the work: PowerShell, cmd, WMI, RDP and legitimate remote access software appear in the middle of nearly every intrusion.
• Credentials drive the spread: credential dumping and Kerberos abuse turn one foothold into domain-wide access.
• The end is theft and denial of recovery: exfiltration to cloud storage, encryption and the deletion of backups are the techniques that turn an intrusion into a breach.

The Top 10 at a glance

The order follows the attack lifecycle rather than strict frequency, because the reports measure different things (root cause, initial access, technique prevalence). All IDs are checked against ATT&CK v20.

1. Exploit Public-Facing Application (T1190)

How it shows up: attackers exploit VPN concentrators, firewalls, file transfer servers and web applications, often within days of disclosure and sometimes before a patch exists. Verizon's 2026 DBIR names vulnerability exploitation as the leading initial access route at 31% of breaches. The CitrixBleed, Ivanti Connect Secure and Oracle E-Business Suite campaigns all began this way, and the first two exposed sessions and credentials as well as the device.

Detect: web and appliance logs for exploitation signatures, new processes or files on the appliance, and unexpected outbound connections from edge devices; vendor integrity check tools where they exist.

Break it: track internet-facing assets against the CISA Known Exploited Vulnerabilities catalogue and patch those first (ATT&CK mitigation M1051 Update Software), remove management interfaces from the internet, and plan for replacement of end-of-life appliances. See the Edge Device Exploitation by Threat Actors Guide and the CISA KEV Catalogue Guide.

2. Valid Accounts (T1078) from stolen, guessed or leaked credentials

How it shows up: logins with credentials bought from infostealer logs, sprayed (T1110.003), or found in code and CI variables. Sophos's 2026 Active Adversary Report, covering 661 incident response and MDR cases from November 2024 to October 2025, found compromised credentials were the root cause in 42.06% of cases and brute force in 15.58%, with identity-related root causes at 67.32% combined; MFA was not enabled or not fully configured in 59% of cases. Red Canary's 2025 Threat Detection Report ranked T1078.004 Cloud Accounts as its most prevalent technique. Machine identities count here too: API keys, access keys and tokens are valid accounts to an attacker. The Snowflake customer breaches used infostealer credentials without MFA, and the Change Healthcare breach began with one remote access login without MFA.

Detect: failed-then-successful sign-ins (Windows event 4625 followed by 4624), impossible travel and new device sign-ins in your identity provider, and cloud API calls from unfamiliar networks for access keys and service principals.

Break it: phishing-resistant MFA (M1032) on every remote and cloud entry point, infostealer and leaked-secret monitoring, and short-lived machine credentials instead of static keys. See the Top 10 Identity Attacks and the Top 10 NHI Risks.

3. Phishing, including voice and help desk pretexts (T1566)

How it shows up: attachments and links (T1566.001, T1566.002), adversary-in-the-middle pages that capture session cookies (T1557, T1539), and phone calls to staff or the help desk (T1566.004 Spearphishing Voice). Verizon's 2026 DBIR reports that mobile social engineering has a success rate 40% higher than traditional email phishing. Red Canary's 2025 list includes T1204.004 Malicious Copy and Paste, the "paste this command to fix the error" lure. The Uber breach combined a stolen password with MFA fatigue and contact over messaging.

Detect: sign-ins from known AiTM infrastructure, session tokens reused from a new IP, help desk MFA resets followed by new device registration, and Run dialog or terminal launches of PowerShell from a browser context.

Break it: FIDO2 or passkeys for privileged and remote users, call-back verification for help desk resets, and email authentication. See the Top 10 Phishing Techniques.

4. External Remote Services (T1133)

How it shows up: VPN, Citrix, RDP gateways and exposed RDP used with valid credentials. CISA's #StopRansomware Guide lists exploitable VPN access and exposed remote services among the most common ransomware entry points, and tells organisations not to expose RDP to the internet. The Colonial Pipeline attack used an unused VPN account without MFA.

Detect: VPN logins for dormant or leaver accounts, logins without an MFA event, and RDP (TCP 3389) reachable from the internet in external attack surface scans.

Break it: MFA on every remote access path, disable dormant accounts, and close internet-facing RDP (M1042 Disable or Remove Feature or Program). See Exposed RDP Compromise.

5. Command and Scripting Interpreter (T1059)

How it shows up: PowerShell (T1059.001) and Windows Command Shell (T1059.003) ranked second and third in Red Canary's 2025 report, with WMI (T1047) seventh and Ingress Tool Transfer (T1105) fifth. Attackers use them to run discovery, download tools and launch payloads without dropping obvious malware.

Detect: PowerShell Script Block Logging (event 4104 in Microsoft-Windows-PowerShell/Operational), process creation with command line (event 4688 or Sysmon event 1), encoded commands (-EncodedCommand), and Office or browser processes spawning shells.

Break it: application control (WDAC or AppLocker) that puts PowerShell into Constrained Language Mode for standard users, remove PowerShell 2.0, and block script interpreters from launching from user-writable paths. See the PowerShell Security Guide and the Living off the Land Guide.

6. OS Credential Dumping and Kerberos abuse (T1003, T1558.003)

How it shows up: reading LSASS memory (T1003.001), DCSync replication requests from a non-domain-controller (T1003.006) and requesting service tickets for offline cracking (T1558.003 Kerberoasting). Sophos reported that Impacket, a Python toolkit widely used for credential and remote execution attacks, made up 36% of all tools seen in its 2025 cases.

Detect: handle access to lsass.exe (Sysmon event 10), directory replication (event 4662 with the replication GUIDs) from hosts that are not domain controllers, and bursts of event 4769 with RC4 encryption (ticket encryption type 0x17).

Break it: enable LSA protection (RunAsPPL) and Credential Guard, use group managed service accounts or long random passwords for SPN accounts, enforce AES for Kerberos, and keep domain admin logons on tier-0 hosts only (M1026 Privileged Account Management). See the Credential Dumping Guide.

7. Remote Services for lateral movement (T1021)

How it shows up: RDP (T1021.001) and SMB admin shares (T1021.002) with harvested credentials. Sophos found internal RDP use in 66% of its 2025 cases.

Detect: event 4624 logon type 10 (RemoteInteractive) and type 3 network logons between workstations, one account logging on to many hosts in a short window, and admin share access from non-admin hosts.

Break it: block workstation-to-workstation RDP and SMB with host firewalls, segment server tiers (M1030 Network Segmentation), and deny network and RDP logon for privileged accounts outside their tier. See the Lateral Movement Guide.

8. Remote Access Tools (T1219)

How it shows up: attackers install legitimate remote monitoring and management or remote desktop software for persistent, encrypted access that blends in with IT support. Sophos named AnyDesk the most abused remote access tool in its 2025 cases.

Detect: installation or first execution of remote access software not on the approved list, and connections to RMM vendor relay infrastructure from hosts that should not use it.

Break it: allow-list one approved tool, block others with application control and DNS or proxy rules, and require MFA for the approved tool's console. See the RMM Tool Security Guide.

9. Exfiltration to cloud storage (T1567.002) and data from cloud storage (T1530)

How it shows up: data staged with archivers (Sophos named WinRAR the most abused archiving tool) and pushed to cloud storage or file sharing services, or read directly from cloud buckets and SaaS with stolen keys. Red Canary ranked T1530 Data From Cloud Storage fourth in 2025. Sophos measured a median of just over three days (78.83 hours) from the start of an attack to exfiltration.

Detect: large outbound transfers to storage providers you do not use, command-line sync tools appearing on servers, and unusual bulk GetObject or list activity in cloud logs.

Break it: egress filtering for servers, block unapproved storage domains at the proxy, data access logging on sensitive buckets and least-privilege machine credentials. See the Data Exfiltration Guide.

10. Data Encrypted for Impact (T1486) and Inhibit System Recovery (T1490)

How it shows up: ransomware deletes shadow copies and backups first, then encrypts servers, hypervisors or cloud storage. CISA's #StopRansomware Guide notes that many ransomware variants try to find and delete accessible backups. The Codefinger campaign encrypted S3 objects using AWS's own encryption with stolen keys. Before impact, attackers often disable security tools (T1685 Disable or Modify Tools, in the v20 Defense Impairment tactic TA0112).

Detect: vssadmin delete shadows, wbadmin delete catalog and bcdedit recovery changes, backup job deletion or retention changes, EDR tamper alerts, and mass file renames.

Break it: immutable and logically isolated backups with separate identities (M1053 Data Backup), tested restores, and tamper protection on EDR. See the Backup Security and Immutable Backup Guide.

Mapping to MITRE ATT&CK

In NIST CSF 2.0 terms, techniques 1 to 4 are mostly PR.AA and ID.RA work, 5 to 9 are DE.CM detection, and 10 is PR.DS-11 (backups are created, protected, maintained and tested) and the RC recovery function.

Detection and measurement

Run a purple team exercise each quarter that chains at least four of the ten techniques, and measure time to detect at each stage, not only whether an alert fired.

Where to start

1. Close the front doors: list internet-facing systems, patch KEV-listed flaws, remove exposed RDP and put phishing-resistant MFA on every remote and cloud entry (techniques 1 to 4).
2. Turn on the telemetry: PowerShell Script Block Logging, process command line auditing, Sysmon or EDR on servers, and identity provider sign-in logs into the SIEM (techniques 2, 5 and 6).
3. Protect credentials: LSA protection and Credential Guard, gMSA for service accounts, and tiered admin logons; pilot on one server group, watch for broken legacy authentication packages, and roll back by policy if needed (techniques 6 and 7).
4. Control remote tooling and egress: one approved RMM tool, and blocked unapproved storage destinations from servers (techniques 8 and 9).
5. Make recovery survivable: isolated, immutable backups under separate identities, tested by restore (technique 10).

Small organisations should do step 1 and the backup half of step 5 before anything else, often through a managed provider. Larger organisations should map existing detections to the ten IDs and fill gaps in that order. See the Top 10 Ransomware Initial Access Vectors for more depth on the first stage.

Standards and references

• MITRE ATT&CK: Enterprise Matrix
• CISA: Known Exploited Vulnerabilities Catalog
• CISA: #StopRansomware Guide
• Verizon: 2026 Data Breach Investigations Report findings
• Sophos: 2026 Active Adversary Report
• Red Canary: Threat Detection Report, top techniques
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: MITRE ATT&CK Guide for Defenders · Top 10 Identity Attacks · Initial Access Techniques Guide · Verizon DBIR · Top 10 EDR Evasion Techniques