What is initial access?¶

Initial access is the point at which an offender first gains a foothold in an account, device, application or network.

Avoid the dangerous assumption¶

The dangerous assumption is that the first suspicious event in the timeline must be the initial access event.

It may not be.

The offender may have obtained access earlier and remained quiet until later activity became visible.

Initial access may occur through:

• stolen credentials
• phishing
• remote-access software
• exploitation of a public-facing service
• a malicious file
• a compromised supplier
• an exposed administrative service
• a trusted application
• physical access
• misuse of an existing account.

Investigators should define what “access” means in the specific case.

Was an account authenticated?

Was code executed?

Was a device remotely controlled?

Was a service exploited?

Was an application permission granted?

Was data reached without taking control of the wider environment?

The initial access route matters because it determines which records may exist and which other systems may have been affected.

Relevant evidence may include authentication logs, email records, web-server logs, endpoint activity, cloud audit records, device artefacts and provider data.

Do not assume that one plausible route excludes others. An offender may possess stolen credentials and also exploit an exposed service.

Likewise, proving later persistence or lateral movement does not automatically prove how the first foothold was obtained.

The exact point of entry may remain uncertain. In that case, identify the earliest supported access event and report the alternatives.

Operational takeaway¶

Identify the earliest supported foothold, define what access was gained and avoid treating the first detected event as automatic proof of the initial access route.