What are common Initial Access techniques in MITRE ATT&CK, and how can detections be built around them?

• A. Phishing, exploitation of public-facing apps, and valid accounts; detections include email filtering, account behavior analytics, URL/file reputation checks, and monitoring authentication anomalies
• B. Only malware payload detection
• C. Phishing and valid accounts but no detections for anomalies
• D. Webhooks-based detection only

Answer: (A)

Initial access is about how an attacker first gains entry into an environment. In MITRE ATT&CK, several common ways attackers get footholds are included under this tactic, and among the most frequent are phishing, exploitation of public-facing applications, and the use of valid accounts. Phishing relies on tricking a user or system to reveal credentials or deliver a malicious payload. Exploiting public-facing apps takes advantage of exposed services that aren’t properly secured or patched, giving an attacker a way to enter without needing user interaction. Valid accounts involve compromising legitimate credentials or using them in a way that bypasses typical malware-focused detections, allowing access with a trusted identity.

Detections should be built by aligning telemetry to these techniques and applying layered controls. For phishing, deploy strong email filtering, link and attachment reputation checks, URL rewriting and sandboxing of attachments, and user awareness programs to reduce reliance on a single control. For exploitation of public-facing applications, monitor for unusual or failed access attempts to exposed services, apply and enforce patches, use secure configurations, and deploy web application firewalls and anomaly checks on access patterns to catch attempts at exploitation. For valid accounts, look for anomalous sign-ins such as unusual geolocations or devices, authentication adversaries like credential stuffing or password spraying, and enforce multifactor authentication and device trust to minimize success when credentials are compromised. Correlate these signals in a SIEM/EDR/identity platform to produce detections tied to the specific initial-access techniques, then escalate or respond via automation.

These three techniques collectively capture the most common entry paths and provide practical, multi-layered detection coverage. Other options are too narrow or omit key detection angles, such as focusing only on malware payloads, ignoring anomaly-based authentications, or limiting visibility to webhook activity.