Initial access
Initial access is the attacker objective of gaining a first foothold in a target environment, and the techniques used to attempt that entry.
Getting a foothold
MITRE ATT&CK groups techniques for gaining a first foothold under Initial Access. Examples include phishing, exploiting a public-facing application, and abusing valid accounts. How long that foothold lasts and what it allows depend on the technique and environment.
A tactic describes what the attacker is trying to achieve. Labeling an attempt “Initial Access” does not mean it succeeded.
Where did the attempt get to?
If the help desk rejects an impersonator’s recovery request without changing the account, the attacker tried an entry route but did not gain access through it.
For a test, agree in advance what counts as gaining access. A delivered message, conversation, approved reset, successful sign-in, and action inside an application are different results. Record the furthest stage you can confirm.
If an investigation’s records start after the compromise, call the first event the earliest observed access. It may not be the attacker’s actual first step.