# A Taxonomy for Threat Actors' Delivery Techniques
## 5 Our Proposal
### Mapping to Mitre Att?&ck
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Technique ID** & **Name** & **Number of Groups** \\ \hline T1189 & Drive-by Compromise & 24 \\ \hline T1190 & Exploit Public-Facing Application & 16 \\ \hline T1133 & External Remote Services & 20 \\ \hline T1200 & Hardware Additions & 1 \\ \hline T1566.001 & Spear phishing Attachment & 64 \\ \hline T1566.002 & Spear phishing Link & 34 \\ \hline T1566.003 & Spear phishing via Service & 7 \\ \hline T1091 & Replication Through Removable Media & 4 \\ \hline T1195.001 & Compromise Software Dependencies and & \\  & Development Tools & 0 \\ \hline T1195.002 & Compromise Software Supply Chain & 6 \\ \hline T1195.003 & Compromise Hardware Supply Chain & 0 \\ \hline T1199 & Trusted Relationship & 5 \\ \hline T1078.001 & Valid Accounts: Default & 0 \\ \hline T1078.002 & Valid Accounts: Domain & 10 \\ \hline T1078.003 & Valid Accounts: Local & 8 \\ \hline T1078.004 & Valid Accounts: Cloud & 2 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Delivery techniques exploited by threat actors. Please note that a single threat group can be executing more than one initial access technique, and also that those techniques or sub-techniques with zero groups mean only that they have been observed in real operations but attribution has not been possible. With this information, we can conclude that different spear phishing techniques are the most widely used, while supply chain compromises can be only performed by specific threat actors; particularly, no identified threat actor is able to compromise the hardware or dependencies and developmental tool supply chains, although MITRE ATT&CK identifies these techniques as the ones used to gain initial access. Of course these results are consistent with the findings we have exposed in our paper, related to phishing as a key delivery technique and supply chain compromise as a growing trend. As we have previously performed with MITRE ATT&CK techniques, we can map the number of groups performing each technique onto our taxonomy, as shown in Table 6.  
Regarding the delivery object, most groups are able to use techniques based on weaponized objects in order to gain initial access to their targets. Only one of them is able to gain access through not legit objects, in this case, through hardware additions. These data show the importance of protecting organizations against malware coupled with legitimate objects, as the techniques relying on weaponized objects are the most-used ones. This protection can be achieved through perimeter security elements such as web traffic inspection devices or sandboxes for mail attachments or links. While all delivery techniques are important, the probability of being compromised through Weaponized Objects is much higher than the probability of being compromised through a hardware addition; therefore, on a prior basis most organizations must allocate more resources to protect themselves against a malware compromise than to protect themselves against a hardware addition or a supply chain compromise. Finally, it is important to note that only six groups are able to execute different techniques based on undefined delivery objects, all of them through supply chain compromises. As we have stated in this paper, these compromises are not widely exploited, but supply chain attacks are a growing trend. Regarding the delivery vector, Semantic delivery is the most widely used vector. This implies that most groups exploit social engineering techniques to gain access to the target infrastructure, a fact that highlights the importance of security awareness for most organizations. The use of untrusted parties to gain access to the target is also relevant. Threat actors rely on the trojanization of web sites visited by the users of the targeted organization to gain access to their victims. Although this technique can be considered a non-directed one (there is no guarantee about who is visiting the trojanized web site),