> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-dfir-and-mittr/initial-access.md).

# Initial Access

* T1659: Content Injection
* T1189: Drive-by Compromise
* T1190: Exploit Public-Facing Application
* T1133: External Remote Services
* T1200: Hardware Additions
* T1566: Phishing, with sub-techniques like Spearphishing Attachment (T1566.001), Spearphishing Link (T1566.002), Spearphishing via Service (T1566.003), and Spearphishing Voice (T1566.004)
* T1091: Replication Through Removable Media
* T1195: Supply Chain Compromise, with sub-techniques like Compromise Software Dependencies and Development Tools (T1195.001), Compromise Software Supply Chain (T1195.002), and Compromise Hardware Supply Chain (T1195.003)
* T1199: Trusted Relationship
* T1078: Valid Accounts, with sub-techniques like Default Accounts (T1078.001), Domain Accounts (T1078.002), Local Accounts (T1078.003), and Cloud Accounts (T1078.004)