# A Taxonomy for Threat Actors' Delivery Techniques
## 5 Our Proposal
### Mapping to Mitre Att?&ck
\begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{3}{*}{Object (T1195)} & \multirow{3}{*}{Dynamic} & \begin{tabular}{c} Weaponized (T1189, T1566, T1091) \\ \end{tabular} \\ \cline{2-3}  & & \begin{tabular}{c} Non-Weaponized (T1190) \\ \end{tabular} \\ \cline{2-3}  & & \begin{tabular}{c} Legit (T1078, T1199, T1133) \\ \end{tabular} \\ \cline{2-3}  & & \begin{tabular}{c} Not legit (T1200) \\ \end{tabular} \\ \hline \multirow{3}{*}{Vector} & \multirow{3}{*}{Direct} & \multirow{3}{*}{Unintentional} & \begin{tabular}{c} Syntactic \\ (T1190, T1133, T1200, T1091, T1078) \\ \end{tabular} \\ \cline{2-3}  & & \begin{tabular}{c} Semantic (T1566) \\ \end{tabular} \\ \cline{2-3}  & & \begin{tabular}{c} Trusted Party (T1195, 1199) \\ \end{tabular} \\ \cline{2-3}  & & \begin{tabular}{c} Untrusted Party (T1189) \\ \end{tabular} \\ \hline \multirow{3}{*}{Path} & \multirow{3}{*}{Physical} & \begin{tabular}{c} Connected (T1200, T1091, T1195.003) \\ \end{tabular} \\ \cline{2-3}  & & \begin{tabular}{c} Not Connected \\ \end{tabular} \\ \cline{2-3}  & & \
\begin{tabular}{c} Inbound (T1190, T1133, T1195.001, T1195.002, T1078) \\ \end{tabular} \\ \cline{2-3}  & &
\begin{tabular}{c} Outbound (T1189, T1566, T1199) \\ \end{tabular} \\ \hline \hline \end{tabular}
\end{table} 
Table 4: MITRE ATT&CK techniques’ classification by threat group. is increasing in last years, especial since COVID-19 pandemic [71; 72]. We find it mandatory to provide a more exhaustive analysis of this technique from the perspective of the delivery object, identifying the different approaches through static and dynamic objects that this technique can be executed with. This analysis would provide organizations better countermeasures to prevent, detect and neutralize supply chain attacks. Regarding the delivery vector, all techniques are classified into low-level nodes. In this case we find an important gap; as MITRE ATT&CK does not consider deliberate delivery, this is the abuse of an insider from the target organization voluntary helping the hostile actor to achieve its goals. Although not usually considered when dealing with delivery, the insider threat has been a relevant problem for years; thus, we find it mandatory to identify delivery techniques (including the human aspects) for this threat. Dealing with the delivery vector, it is also interesting that phishing, being the most-used delivery technique, is the only one identified as semantic, as most techniques are classified as syntactic. The framework should delve into semantic delivery vectors, as people have always been the weakest link in the security chain and there are different delivery techniques that benefit from social engineering, as we have discussed in Section 6. Finally, regarding the delivery path, MITRE ATT&CK identifies delivery techniques both for a physical and a logical compromise, although most of the delivery techniques analyzed from hostile actors reports are based on a logical delivery. We must highlight the fact that the not connected physical delivery path has no linked techniques; this means that these kinds of delivery approaches are not considered in MITRE ATT&CK; thus, most defensive teams are also not considering them in their security countermeasures. The framework should delve into different techniques to physically break the security perimeter of an organization and deploy an autonomous, not connected implant. If we delve into the particular delivery techniques that threat actors are performing, the data from MITRE ATT&CK allows the linking between groups and techniques. In Table 5, this relationship is shown, exposing the number of threat groups using each initial access technique or sub technique.