# A Taxonomy for Threat Actors' Delivery Techniques
## 5 Our Proposal  
Initial access, or delivery, is just the compromise of the target security perimeter. This security perimeter is the boundary within security control measures, which are in effect to protect assets [58]. The compromise is always a break in from outside the target premises to inside them, no matter where the tactic is initiated from; please note that in our proposal, we identify inbound and outbound logical paths for delivery, but this classification refers only to the initial connection for a logical compromise, not to the whole tactic. To compromise the target perimeter, we identify three mandatory elements: an artifact, a transport vector from this artifact to the target's premises, and a path to break the perimeter. In this sense, in order to establish a taxonomy for delivery techniques, we provide the following definitions:  
Delivery Object, is the object used to break the target's perimeter. This object is usually a deliverable artifact generated by a weaponizer, in which the malicious payload is embedded, typically in the form of an application data file such as Adobe Portable Document Format or Microsoft Office. However, our concept of object includes not only ad hoc, malicious artifacts, such as links or files, but also points out the infrastructure to be abused by hostile actors, such as public facing services. Delivery Vector, is the transport used to deliver the artifact to its target. Examples of delivery vectors include USB memory drives, mail messages, hardware implants, or supply chains. Delivery Path, is the way the delivery vector breaks the target's perimeter. Although in some cases this delivery path is directly linked to the delivery vector, in other cases they are independent, as we well analyze later in this work. Examples of delivery paths include both physical and logical routes to the target. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Family** & **References** & **Pros** & **Cons** \\ \hline \multirow{3}{*}{General models} & \multirow{3}{*}{[13; 24; 25; 26; 27]} & Industry standards & Plain structure \\  & & Specifications based on real attacks & Not an in-depth analysis \\  & & Useful for the identification of particular & Not designed for the identification \\  & & techniques in offensive operations & of security gaps \\ \hline \multirow{3}{*}{Threat actors reports} & \multirow{3}{*}{[28; 29; 30; 31]} & Real world cases & Focus on specific delivery techniques \\  & & In-depth analysis for each case & No structure proposal \\  & & New delivery techniques are presented & \\ \hline \multirow{3}{*}{Initial classifications} & \multirow{3}{*}{[32; 33]} & Initial structure for techniques & Not focused on delivery, but \\  & & Real techniques mapping & general approaches \\  & & & Date of publication \\ \hline \multirow{3}{*}{Malware-focused} & \multirow{3}{*}{[26; 34; 35; 36]} & In-depth analysis for malware delivery & Focus on specific s: malware \\  & & Detection oriented & and malware related \\  & & Malware as a relevant threat & Not designed to identify security \\  & & & gaps outside malware ecosystem \\ \hline \multirow{3}{*}{General techniques} & \multirow{3}{*}{[37; 38; 39; 40; 41; 42; 43; 44; 45; 46; 47; 48]} & Delivery techniques analyzed with a global & No classification proposal \\  & & operation perspective: completeness & Not in-depth analysis \\  & & Real world cases & Focus on particular techniques, without \\ \hline \multirow{3}{*}{Particular techniques} & \multirow{3}{*}{[49; 50; 51; 52; 53; 54; 55; 56; 57]} & In-depth analysis of particular techniques & Focus on particular techniques, without \\  & & Structure proposals for these techniques & considering a global delivery scheme \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparative literature study. To achieve the delivery tactic, an object is used or abused by a threat actor, who delivers it to its target by a delivery vector and breaks the perimeter through a specific path.