# A Taxonomy for Threat Actors' Delivery Techniques
## 5 Our Proposal
If this first connection is started from the organization's premises, such as in phishing techniques, we refer to the outbound logical path, while if it is started outside these premises, such as in the abuse of valid accounts, we refer to the inbound logical path. This distinction is specially relevant for our taxonomy, as it allows us to fine tune the identification of particular techniques and their identification, thus enabling organizations to establish better protection mechanisms against the threat. In both cases, it is mandatory to monitor external-facing systems to detect the compromise, but when dealing with inbound logical path techniques, the monitoring efforts must be directed to applications and services exposed to internet. If we deal with an outbound logical path, these monitoring efforts must be directed to the legit external services offered to their own organization. Regarding the physical delivery path, we differentiate between connected and not connected approaches; in this case, a not connected physical delivery path is the one that breaks the physical security perimeter of the organization once, not connecting the delivery object to the target IT infrastructure. On the other hand, a connected physical delivery path represents a double security perimeter violation: the first one, the physical, gets into the target, and the second one, logical, connects the delivery object to the target infrastructure. Again, this difference is relevant for the identification of the particular technique used by a threat actor and thus for the identification and deployment of appropriate countermeasures. While dealing with connected approaches, in which we find a double perimeter compromise, it is possible to establish two layers of security countermeasures. On the other hand, in not connected approaches there is a single compromise, so from the perimeter's point of view only a checkpoint can be established, although other countermeasures, not specifically perimeter-related, can also be deployed, especially for the monitoring of the object activities in the target. The full delivery path-proposed taxonomy is shown in Figure 4. As we have previously stated, the delivery path represents the compromised perimeter for the target, the physical and logical perimeters being the considered ones in our work. Inside both of them we identify the different approaches that detail this compromise, as these approaches allow analysts to detect known delivery techniques and to identify novel ones. Figure 4: Delivery Paths’ taxonomy. Figure 3: Delivery Vectors’ taxonomy. By setting the object, the vector, and the path we can classify all delivery techniques into our taxonomy. These items provide a global view of the tactic, as they themselves define the delivery process: an object is sent through a specific vector to the target, physically or logically breaking its perimeter, to achieve the tactic goal. In Table 2, we summarize the proposed taxonomy. Following our proposed approach, we can classify all the delivery techniques and identify security gaps to establish countermeasures against them. We have selected two of the most widely used techniques for Initial Access, spear phishing, and the abuse of valid user accounts on external-facing infrastructure. We can classify them into the proposed categories for delivery object, vector, and path, as an example regarding how our proposed taxonomy can be applied. Spear phishing is a particular type of phishing, in which the target and context are previously investigated so that the email is tailored to the receiver [65; 66]. These actions are executed by sending a malicious object (typically a file or a link) by e-mail to a particular target [67]. This object is specially crafted to detonate when it is accessed by the receiver, who opens it as a legitimate e-mail; when it detonates, the malicious payload is executed and the threat actor can continue with further steps of the cyber-kill chain.