Real-world initial access vectors mapped to MITRE ATT&CK
Understanding infection methods helps researchers connect payloads to real-world attack scenarios. Red teams use this for realistic simulations; blue teams for detection engineering and user awareness training. Each method below represents documented TTPs from actual threat actor campaigns.
Targeted email with malicious Office document containing macro
Link to fake login page harvesting credentials
HTML attachment using JavaScript to reconstruct payload client-side
Compromised ad network serving exploit kits
Compromising websites frequented by target audience
Fake package/repository mimicking legitimate source
Infected USB drives left in public areas
Posing as IT/vendor to gain physical or remote access
Injecting malware into legitimate software updates
Direct exploitation of vulnerable internet-facing services
Spreading from initial access to other systems
Research Purpose: This information is for authorized security testing, threat intelligence, and defensive operations only. All techniques documented here are based on publicly available threat actor TTPs.