Cyber Kill Chain & MITRE ATT&CK
Two useful frameworks for understanding how attacks progress, how adversary behavior can be described, and where defenders can detect and respond.
Use one concept from this guide as the daily topic, ask a practical question, then send learners here for the detailed explanation.
1. What is the Cyber Kill Chain?
The Cyber Kill Chain is a seven-stage model developed by Lockheed Martin to describe an intrusion from the attacker's perspective. It is useful for understanding the broad sequence of an attack and identifying opportunities to disrupt it.
- Reconnaissance — gathering information about the target.
- Weaponization — preparing a malicious payload or capability.
- Delivery — getting the payload to the target, such as through phishing or another delivery method.
- Exploitation — triggering a vulnerability or executing the delivered content.
- Installation — establishing malware or another form of persistent access.
- Command & Control — communicating with attacker-controlled infrastructure.
- Actions on Objectives — achieving the attacker's goal, such as theft, disruption or encryption.
Security value: the model helps analysts ask, “Where in the attack flow are we seeing evidence, and where can we interrupt it?”
2. What is MITRE ATT&CK?
MITRE ATT&CK is a knowledge base of adversary behavior built around tactics and techniques. It gives defenders a more detailed vocabulary for describing what an attacker is doing and helps with detection engineering, threat hunting, investigation and coverage analysis.
Tactics vs techniques
- Tactics describe the adversary's goal or reason for an action, such as Execution, Credential Access, Discovery or Lateral Movement.
- Techniques describe the behavior used to achieve that goal, such as Command and Scripting Interpreter or Remote Services.
- Sub-techniques provide additional detail where ATT&CK defines it.
ATT&CK is not a checklist that proves an attack happened. A technique should be mapped only when the available evidence supports the behavior.
3. Cyber Kill Chain vs MITRE ATT&CK
| Cyber Kill Chain | MITRE ATT&CK |
|---|---|
| Seven broad attack stages | Detailed adversary tactics and techniques |
| High-level attack flow | Detailed behavior vocabulary |
| Useful for understanding progression | Useful for detection, hunting and coverage |
| Attacker-focused sequence | Behavior-focused knowledge base |
They complement each other. The Kill Chain can provide the high-level storyline, while ATT&CK can add detail about the observed behavior.
4. How to map an investigation
Start with the evidence, not the framework.
- Identify what actually happened in the logs, endpoint telemetry or network telemetry.
- Describe the behavior in plain language.
- Determine whether that behavior is represented by an ATT&CK technique or sub-technique.
- Map it only when the evidence supports the mapping.
- Use the mapping to improve detection, hunting and investigation—not as a substitute for evidence.
Example: if telemetry shows a process launching PowerShell, an analyst can investigate the parent process, user, command line, timing, destination connections and surrounding events before considering an ATT&CK mapping for the observed behavior.
5. Ransomware example
Consider a simplified investigation where a user receives a malicious phishing attachment, execution follows, the endpoint establishes external communication, and files are eventually encrypted.
- Delivery: phishing email and attachment.
- Exploitation / Execution: user opens content and a process executes.
- Installation: persistence or other foothold behavior may appear, if present.
- Command & Control: endpoint communicates with external infrastructure.
- Actions on Objectives: files are encrypted and recovery may be disrupted.
ATT&CK can then describe the specific observed behaviors in more detail. The exact mapping depends on the evidence available in the case.
6. What should a SOC analyst look for?
- Authentication anomalies before execution.
- Unexpected parent-child process relationships.
- PowerShell or other command interpreters used in unusual context.
- New or unusual persistence mechanisms.
- Rare DNS queries or periodic outbound connections.
- Unexpected internal connections and lateral movement indicators.
- Unusual file modification or encryption activity.
- Correlated identity, endpoint and network evidence.
7. Detection and investigation workflow
- Alert: understand exactly what triggered.
- Validate: establish user, host, source, destination and time context.
- Correlate: search for preceding and following events.
- Map behavior: use ATT&CK when supported by evidence.
- Build the timeline: connect authentication, endpoint and network activity.
- Scope: determine affected users, hosts and systems.
- Respond: follow the organization's authorized incident-response procedure.
- Improve: tune detections and document coverage gaps.
8. Visual foundation
The following RR CyberLabs graphic summarizes the two frameworks, their relationship, a ransomware example and the main investigation data sources.
9. Key takeaways
- The Cyber Kill Chain gives a simple, high-level view of attack progression.
- MITRE ATT&CK gives defenders a detailed vocabulary for adversary behavior.
- Neither framework replaces evidence or investigation.
- Use the frameworks to organize evidence, improve detections and identify gaps.
- Good analysts explain what happened, what evidence supports it, what is still unknown, and what should happen next.