Initial access techniques: all 11 in MITRE ATT&CK

MITRE ATT&CK lists 11 initial access techniques under tactic TA0001. This post reproduces that full list, with each technique ID, name and MITRE’s own one-line description, as shown on the TA0001 Enterprise page (created 17 October 2018, last modified 25 April 2025). It is a complete list, not a ranking: the order is MITRE’s page order and says nothing about how often a technique is used.

What does MITRE mean by initial access?

The TA0001 page puts it in one line: “The adversary is trying to get into your network.” It says Initial Access “consists of techniques that use various entry vectors to gain their initial foothold within a network.”

The page gives two examples of how a foothold is gained: targeted spearphishing and exploiting weaknesses on public-facing web servers. It also says a foothold may allow continued access, like valid accounts and use of external remote services, or may be limited-use due to changing passwords.

How many initial access techniques are there?

The TA0001 page shows 11 techniques. Three of them list sub-techniques on the same page: Phishing (T1566), Supply Chain Compromise (T1195) and Valid Accounts (T1078). The other eight are listed without sub-techniques.

Which techniques does the TA0001 page list?

Below, each entry gives the ID, the name and the first sentence of MITRE’s description, in the order the page shows them.

1. T1659, Content Injection. “Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic.”
2. T1189, Drive-by Compromise. “Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.”
3. T1190, Exploit Public-Facing Application. “Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.” MITRE adds that the weakness can be a software bug, a temporary glitch, or a misconfiguration. See Exploit Public-Facing Application.
4. T1133, External Remote Services. “Adversaries may leverage external-facing remote services to initially access and/or persist within a network.” See External Remote Services.
5. T1200, Hardware Additions. “Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access.”
6. T1566, Phishing. “Adversaries may send phishing messages to gain access to victim systems.” MITRE states that all forms of phishing are electronically delivered social engineering. Sub-techniques listed: Spearphishing Attachment (.001), Spearphishing Link (.002), Spearphishing via Service (.003) and Spearphishing Voice (.004). See Phishing.
7. T1091, Replication Through Removable Media. “Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.”
8. T1195, Supply Chain Compromise. “Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.” Sub-techniques listed: Compromise Software Dependencies and Development Tools (.001), Compromise Software Supply Chain (.002) and Compromise Hardware Supply Chain (.003).
9. T1199, Trusted Relationship. “Adversaries may breach or otherwise leverage organizations who have access to intended victims.”
10. T1078, Valid Accounts. “Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.” Sub-techniques listed: Default Accounts (.001), Domain Accounts (.002), Local Accounts (.003) and Cloud Accounts (.004). See Valid Accounts.
11. T1669, Wi-Fi Networks. “Adversaries may gain initial access to target systems by connecting to wireless networks.”

Where does the list touch other topics?

Three entries connect to other posts on this site. T1195 covers manipulation of products before they reach a final consumer; for the wider picture, read the rise of supply chain cyber attacks. T1078 covers abuse of existing credentials; for how access is offered for sale, see the anatomy of an initial access broker listing. For how quickly an intruder moves after getting in, see breakout time vs dwell time.

What does the page not tell you?

The TA0001 page lists techniques and descriptions. It does not rank them, and it does not give counts of incidents per technique. Treat it as a checklist of entry routes MITRE has documented as of its last modification date, 25 April 2025. A useful first pass is to take each ID in turn and decide whether it applies to your organization, using the questions above as a start.

To go further, read the phishing trends and exploited vulnerabilities in 2025.