# A Taxonomy for Threat Actors' Delivery Techniques
## 4 Techniques and Limitations  
Until this moment, no valid complete taxonomy for delivery techniques has been identified. All approaches are partial, providing a relationship of delivery techniques but without a particular structure, focusing on an specific type of delivery, or analyzing just particular delivery techniques used by a given threat actor. We miss a global structure to classify delivery techniques, which allows not only this classification but also the identification of security gaps in the monitoring scheme for an organization. Such a taxonomy would allow analysts to detect the compromise of their infrastructures, as well as to identify those monitoring gaps and deploy countermeasures against previously unknown techniques. As we have stated before, MITRE ATT&CK is the key reference for the identification of delivery techniques, identified as Initial Access in the framework. It focuses on the adversary tactics, techniques, and procedures (TTP) derived from real attacks [23]. However, this framework does not provide any classification for these techniques, exposing just a plain relationship for them and their sub-techniques. Although, such as an approximation is useful for the identification of particular techniques used in offensive operations, it lacks a whole structure, so it can not be taken as a valid reference for the definition of a delivery techniques' taxonomy. The Cyber Kill Chain represents a starting point that provides an intelligence framework for understanding the multistage attack. It identifies the \"Delivery\" stage of a hostile operation but it does not provide any information about adversarial tactics and techniques. Following the Cyber Kill Chain stages, and with different kill chain models, many works [13; 24; 25; 26; 27] provide specific examples of delivery techniques; however, few of them discuss these techniques from a threat modeling perspective. In addition to particular examples, no valid taxonomy approach has been identified in these works. In the case of specific operations related to APT activities, we face the same situation; different works [28; 29; 30] analyze the delivery techniques used by Advanced Persistent Threats in their campaigns, providing particular examples of techniques, but none of them present a taxonomy for the delivery tactic. With a more general approach, ref. [31] analyzes life cycles and models for Advanced Persistent Threat operations. In [32], [PERSON] et al. identify two types of delivery techniques: direct and indirect delivery. In direct delivery, the hostile actors send exploits to their targets, while in indirect delivery, they compromise a third party that is trusted by the target, and then they use this compromised third party to indirectly serve exploits to the target. For each category, the authors propose gear phishing and the watering hole, respectively, as examples of techniques. In this work, the goal of the authors is not to provide a taxonomy for delivery techniques, but to present a general survey on Advanced Persistent Threats; for this reason, they do not focus on a particular taxonomy. In addition, as the paper is dated to 2014 we consider this a valid initial approach that needs to be enhanced; over the years, advanced threat actors have developed new techniques for the delivery tactic that have to be considered: for example, the exploiting of public facing applications. A similar approach is used in [33], although, in this case the provided examples do not reflect the used categories. As specified in Section 3, most analyses are focused on the delivery of a malicious payload through multiple ways. Malware delivery campaigns have been analyzed in [34], in which [PERSON] et al. adopt three stages from the STIX data model (exploitation, installation and command, and control) to represent malware delivery campaigns.