# A Taxonomy for Threat Actors' Delivery Techniques
## 5 Our Proposal
### Mapping to Mitre Att?&ck  
As stated in this work, MITRE ATT&CK is the main public effort to establish a classification of TTP used by threat actors; for this reason, we have performed a mapping of the MITRE ATT&CK Enterprise \"Initial Access\" (the given name in the framework to the delivery) tactic onto our proposed structure. At the time of this writing, MITRE ATT&CK Enterprise \"Initial Access\" tactic (last modified on 19 July 2019), identified as TA0001, consists of techniques that use various \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \multicolumn{1}{c}{Dynamic} & \multicolumn{2}{c}{Weaponized} \\ \cline{3-4} Object & & \multicolumn{2}{c}{Not Weaponized} \\ \cline{3-4}  & Static & & Legit \\ \cline{3-4}  & & & Not legit \\ \hline \multirow{4}{*}{Vector} & \multirow{4}{*}{Direct} & \multicolumn{2}{c}{Deliberate} \\ \cline{3-4}  & & & Unintentional & Syntactic \\ \cline{3-4}  & & & Semantic \\ \cline{3-4}  & & & Trusted Party \\ \cline{3-4}  & & & Untrusted Party \\ \hline \multirow{4}{*}{Path} & \multirow{4}{*}{Physical} & \multicolumn{2}{c}{Connected} \\ \cline{3-4}  & & & Not Connected \\ \cline{3-4}  & & & Inbound \\ \cline{3-4}  & & & Outbound \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Proposed taxonomy for delivery techniques. entry vectors to gain an initial foothold within a network. Techniques used to gain a foothold include targeted spear phishing and exploiting weaknesses on public-facing web servers. Footholds gained through initial access may allow for continued access, such as valid accounts and the use of external remote services, or may be limited-use, due to changing passwords. For this particular tactic, MITRE ATT&CK identifies the techniques shown in Table 3.  
T1189, Drive-by Compromise, refers to the threat actor gaining access to a system through a user visiting a website over the normal course of browsing. In this technique, the object is a dynamic and weaponized; the vector is indirect, through an untrusted party; and the path is logical and outbound. T1190, the Exploit Public-Facing Application, refers to the threat actor taking advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior. In this technique, the object is dynamic and not weaponized; the vector is direct, unintentional, and syntactic; and the path is logical and inbound. T1133, External Remote Services, refers to the threat actor leveraging external-facing remote services to initially access and/or persist within a network. In this technique, the object is static and legit; the vector is direct, unintentional, and syntactic; and the path is logical and inbound. T1200, Hardware Additions, refers to the threat actor introducing computer accessories, computers, or networking hardware into a system or network that can be used as a vector to gain access. In this technique, the object is static and legit; the vector is direct and unintentional; and the path is physical and connected. T1566, Phishing, refers to the threat actor sending phishing messages to gain access to victim systems; all forms of phishing are electronically delivered social engineering. T1566 presents three sub-techniques, and in all of them the object is dynamic and weaponized; the vector is direct, unintentional, and semantic; and the path is logical and outbound. T1091, Replication Through Removable Media, refers to the threat actor moving onto systems, possibly those on disconnected or air-gapped networks, by copying malware to