Cyber Kill Chain & MITRE ATT&CK

If you cannot map a breach to ATT&CK Techniques, you cannot communicate with another defender. The Lockheed Martin kill chain (2011) and MITRE ATT&CK (2013-present) are the two frameworks every report, every SIEM rule, and every EDR alert uses. Knowing which technique ID maps to “DLL side-loading” (T1574.002) or “Kerberoasting” (T1558.003) is the difference between reading a threat report and writing one. This module covers the kill chain stages, the 14 Enterprise ATT&CK tactics, sub-technique IDs, and real attack group mappings (APT29/SolarWinds, DarkSide/Colonial Pipeline, HAFNIUM/ProxyLogon) so you can do the mapping yourself.

The Core Concept

Two frameworks, two granularities:

1. Lockheed Martin Cyber Kill Chain (2011) — 7 stages. Coarse. Linear. Maps well to intrusion detection: each stage has a defender action.
2. MITRE ATT&CK — 14 Enterprise tactics (TA0xxx), each with multiple techniques (T1xxx) and sub-techniques (T1xxx.00x). Granular. Non-linear. Maps well to adversary emulation.

Lockheed Martin kill chain (2011)
   1. Reconnaissance
   2. Weaponization
   3. Delivery
   4. Exploitation
   5. Installation
   6. Command and Control
   7. Actions on Objectives

MITRE ATT&CK Enterprise (v13)
   TA0043  Reconnaissance
   TA0042  Resource Development
   TA0001  Initial Access
   TA0002  Execution
   TA0003  Persistence
   TA0004  Privilege Escalation
   TA0005  Defense Evasion
   TA0006  Credential Access
   TA0007  Discovery
   TA0008  Lateral Movement
   TA0009  Collection
   TA0011  Command and Control
   TA0010  Exfiltration
   TA0040  Impact

Kill chain stages 1–2 map to ATT&CK Tactics TA0043–TA0042 (the “Pre-ATT&CK” domain). Stages 3–4 map to TA0001. Stages 5–6 map to TA0002/TA0003 (and overlap with TA0005, TA0011). Stage 7 maps to TA0009/TA0010/TA0040. The mapping is not 1:1 — ATT&CK explicitly avoids the linear model because real intrusions skip stages, repeat stages, and operate in parallel.

How It Works

1. Kill chain stage to ATT&CK tactic mapping:

   Kill Chain Stage	ATT&CK Tactic	Typical Techniques
   1. Reconnaissance	TA0043	T1592 Gather Victim Host Info, T1589 Gather Victim Identity Info
   2. Weaponization	TA0042	T1583 Acquire Infrastructure, T1587 Develop Capabilities, T1588 Obtain Capabilities
   3. Delivery	TA0001	T1566 Phishing, T1190 Exploit Public-Facing Application, T1195 Supply Chain Compromise, T1078 Valid Accounts
   4. Exploitation	TA0002 (and overlap)	T1059 Command and Scripting Interpreter, T1203 Exploitation for Client Execution
   5. Installation	TA0003	T1546 Event Triggered Execution, T1547 Boot or Logon Autostart, T1543.003 systemd Service
   6. Command & Control	TA0011	T1071 Application Layer Protocol, T1573 Encrypted Channel, T1090 Proxy
   7. Actions on Objectives	TA0009 + TA0010 + TA0040	T1003 OS Credential Dumping, T1560 Archive Collected Data, T1485 Data Destruction, T1486 Data Encrypted for Impact

2. ATT&CK ID formats:

   • TA0xxx — Tactic (a phase of attack).
   • T1xxx — Technique.
   • T1xxx.0xx — Sub-technique.
   • T1xxx[+/-] — deprecated / revoked / split.
   • Gxxxx — Group (named adversary).
   • Sxxxx — Software (tool used by adversary).
   • Cxxxx — Campaign.
   • Mxxxx — Mitigation.

3. The 14 Enterprise Tactics — what each captures:

   • TA0043 Reconnaissance — gathering information before access. Includes scanning OSINT, DNS enumeration, password spraying for valid usernames.
   • TA0042 Resource Development — building the attack infrastructure (C2 servers, certificates, code signing, exploit kits).
   • TA0001 Initial Access — getting in. Phishing, supply chain, public-app exploit, stolen credentials.
   • TA0002 Execution — running attacker code on the target.
   • TA0003 Persistence — surviving reboots and account audits.
   • TA0004 Privilege Escalation — going from user to admin/root.
   • TA0005 Defense Evasion — avoiding detection.
   • TA0006 Credential Access — extracting secrets.
   • TA0007 Discovery — mapping the environment after access.
   • TA0008 Lateral Movement — pivoting to other systems.
   • TA0009 Collection — gathering the data to steal.
   • TA0011 Command and Control — the channel back home.
   • TA0010 Exfiltration — moving the data out.
   • TA0040 Impact — destroying, encrypting, or denying service to the data.

4. Technique IDs to know cold (the ones in every report):

   ID	Technique	Common Tool / Real Example
   T1566.001	Phishing: Spearphishing Attachment	APT28 (Fancy Bear) — Weaponized Office docs
   T1566.002	Phishing: Spearphishing Link	APT29 (Cozy Bear) — Credential phishing
   T1190	Exploit Public-Facing Application	ProxyLogon (CVE-2021-26855)
   T1195.002	Supply Chain Compromise: Compromise Software Supply Chain	SolarWinds (SUNBURST, APT29/Nobelium)
   T1078	Valid Accounts	Colonial Pipeline (DarkSide) — VPN cred
   T1059.001	PowerShell	Empire, PowerSploit
   T1059.004	Unix Shell	Log4Shell post-exploitation
   T1003.001	OS Credential Dumping: LSASS Memory	mimikatz sekurlsa::logonpasswords
   T1003.002	OS Credential Dumping: Security Account Manager	secretsdump.py, HiveNightmare
   T1003.006	OS Credential Dumping: DCSync	impacket-secretsdump -just-dc
   T1558.003	Steal or Forge Kerberos Tickets: Kerberoasting	GetUserSPNs.py, Rubeus kerberoast
   T1068	Exploitation for Privilege Escalation	CVE-2021-4034 PwnKit, CVE-2022-0847 Dirty Pipe
   T1574.002	Hijack Execution Flow: DLL Side-Loading	SolarWinds (SUNBURST loaded by SolarWinds.Orion.Core.BusinessLayer.dll)
   T1547.009	Boot or Logon Autostart: Shortcut Modification	APT29 — lnk files in Startup
   T1546.003	Event Triggered Execution: WMI Event Subscription	persistence on every Windows host
   T1071.001	Application Layer Protocol: Web Protocols	HTTPS-based C2 — Cobalt Strike, Sliver
   T1071.004	Application Layer Protocol: DNS	DNS tunneling — dnscat2, Cobalt Strike
   T1090.001	Proxy: Internal Proxy	pivots, SOCKS via chisel
   T1090.004	Proxy: Domain Fronting	APT29, APT41 — cdn.example.com fronting
   T1070.001	Indicator Removal: Clear Windows Event Log	wevtutil cl
   T1486	Data Encrypted for Impact	LockBit, BlackCat, DarkSide, Conti
   T1485	Data Destruction	sdelete, shred, WhisperGate
   T1560.001	Archive Collected Data: Archive via ZIP	7z a loot.zip, tar czf
   T1041	Exfiltration Over C2 Channel	HTTPS POST back through Cobalt Strike

5. Real attack group → ATT&CK technique mappings:

   • APT29 (Cozy Bear), UNC2452 / Nobelium / SolarWinds 2020:

     • T1195.002 Supply Chain Compromise (SolarWinds Orion update).
     • T1574.002 DLL Side-Loading (SUNBURST loaded by SolarWinds.Orion.Core.BusinessLayer.dll).
     • T1071.001 Web Protocols for C2 (HTTPS to look-alike domains like avast-v-downloads.com).
     • T1070.004 File Deletion (SUNBURST self-deletes after 14 days of no callback).
     • T1606.001 Forge Web Credentials: SAML Tokens (Golden SAML — Microsoft AD FS server compromised to forge SAML tokens).
     • T1552.001 Credentials In Files (the SUNBURST config blob is encrypted with a key derived from the host’s machineguid).

   • DarkSide (Colonial Pipeline, May 2021):

     • T1078 Valid Accounts (VPN credential from a reused password).
     • T1003 OS Credential Dumping (Mimikatz after landing).
     • T1087 Account Discovery (AD enumeration).
     • T1485 Data Destruction + T1486 Data Encrypted for Impact (ransomware deployment across 100GB of storage).
     • T1041 Exfiltration Over C2 (double extortion — exfil before encrypt).

   • HAFNIUM (Microsoft Exchange ProxyLogon, March 2021):

     • T1190 Exploit Public-Facing Application (CVE-2021-26855 SSRF; combined with CVE-2021-26857, CVE-2021-26858, CVE-2021-27065).
     • T1505.003 Server Software Component: Web Shell (aspx webshells dropped to C:\inetpub\wwwroot\aspnet_client\).
     • T1059.001 PowerShell (for download of next-stage).
     • T1087 Account Discovery, T1119 Automated Collection, T1567 Exfiltration Over Web Service (Ex.Mass exfil to MEGA).

6. Kill chain limitations — Lockheed Martin published the kill chain in 2011; it has known issues:

   • Linear — real intrusions skip stages and repeat them.
   • No persistence loop — once “Actions on Objectives” is reached, the model ends; in reality, attackers loop back to Discovery and Lateral Movement.
   • No reconnaissance-by-insider case — assumes external attacker.
   • ATT&CK addresses these by being non-linear and including tactics like Defense Evasion that span the entire intrusion.

Common Techniques

ATT&CK ID	Technique	Real Use
T1195.002	Supply Chain Compromise	SolarWinds 2020
T1078	Valid Accounts	Colonial Pipeline 2021, Log4Shell reuse
T1190	Exploit Public App	ProxyLogon 2021, Log4Shell 2021
T1059.001	PowerShell	Empire, PowerSploit, PowerView
T1003.001	LSASS Memory	mimikatz
T1003.006	DCSync	impacket-secretsdump
T1558.003	Kerberoasting	Rubeus, GetUserSPNs.py
T1574.002	DLL Side-Loading	SolarWinds SUNBURST
T1606.001	Forge SAML	APT29 Golden SAML
T1486	Data Encrypted for Impact	LockBit, BlackCat, DarkSide
T1070.001	Clear Windows Event Log	Wiper post-exfil cleanup

Hands-On Commands

# Install ATT&CK Navigator (layer-based visualizer for coverage and detections)
git clone https://github.com/mitre-attack/attack-navigator
cd attack-navigator && docker compose up -d
#   serves on http://localhost:5000
#   Create a layer; color techniques by detection coverage (green/yellow/red).

# Download the ATT&CK STIX bundle (the canonical data source)
curl -s https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json \
  -o enterprise-attack.json
python3 -c "
import json
with open('enterprise-attack.json') as f:
    data = json.load(f)
techniques = [o for o in data['objects'] if o.get('type') == 'attack-pattern']
for t in techniques[:5]:
    print(t.get('external_references',[{}])[0].get('external_id'), t.get('name'))
"

# Map a Sigma rule to its ATT&CK technique
sigmac -t splunk rules/windows/sysmon/sysmon_mimikatz_lsass_access.yml
#   The Sigma rule has a tag: attack.credential_access, attack.t1003.001
#   Sigma2Splunk output includes the ATT&CK IDs in the search.

# Search Mitre ATT&CK by group → technique
curl -s 'https://attack.mitre.org/groups/G0016/' | grep -E 'T1[0-9]{3}' | head -20

# Use ATT&CK-Python-Navigator programmatically
pip install attack-coverage
python3 -c "
from attackcti import attack_client
lift = attack_client()
techniques = lift.get_techniques_by_group('G0018')   # APT28
for t in techniques[:10]:
    print(t['technique_id'], t['technique'])
"

# Build a custom ATT&CK layer file (JSON) for a specific breach
cat > breach-layer.json <<'EOF'
{
  "name": "SolarWinds 2020 mapping",
  "versions": {"attack": "13", "navigator": "4.8.1", "layer": "4.5"},
  "domain": "enterprise-attack",
  "techniques": [
    {"techniqueID": "T1195.002", "color": "#ff6666", "comment": "SolarWinds update compromise"},
    {"techniqueID": "T1574.002", "color": "#ff6666", "comment": "SUNBURST DLL side-load"},
    {"techniqueID": "T1071.001", "color": "#ffaa66", "comment": "HTTPS C2"},
    {"techniqueID": "T1606.001", "color": "#ff6666", "comment": "Golden SAML"}
  ]
}
EOF
# Import into ATT&CK Navigator to see the technique heatmap.

# Use Sigma rules with ATT&CK tags
sigmac -t es-dsl \
  /opt/sigma/rules/windows/builtin/security/win_account_disabled.yml \
  | jq '.query.bool.must[].match | keys'

# ATT&CK Evaluations: per-vendor coverage reports for known adversary emulation plans
# https://attackevals.mitre-engenuity.org/ — APT29, FIN7, Turla emulation plans

Detection — Defender View

The detection angle on ATT&CK is the Sigma rule ecosystem. Sigma is the open-source signature format for SIEM queries; every Sigma rule has tags: attack.t1xxx. Example for T1003.001 LSASS access:

title: LSASS Memory Dump via comsvcs.dll
status: experimental
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains:
      - 'comsvcs.dll'
      - 'MiniDump'
      - '#+'
  condition: selection
tags:
  - attack.credential_access
  - attack.t1003.001

Mapping ATT&CK techniques to your detection stack:

• Sysmon Event ID 1 (ProcessCreate) → catch T1059.001 PowerShell, T1059.004 Unix Shell, T1059.003 Windows Command Shell.
• Sysmon Event ID 3 (NetworkConnect) → catch T1071.001 Web C2, T1071.004 DNS C2.
• Sysmon Event ID 8 (CreateRemoteThread) → catch T1055 Process Injection.
• Sysmon Event ID 10 (ProcessAccess) → catch T1003.001 LSASS access (mimikatz).
• Sysmon Event ID 11 (FileCreate) → catch T1547.001 Run Keys/Startup Folder, T1546.003 WMI persistence artifacts.
• Sysmon Event ID 22 (DNSEvent) → catch T1071.004 DNS C2, T1568 Dynamic Resolution.
• Windows Security 4624 → T1078 Valid Accounts (analyze LogonType patterns).
• Windows Security 4625 → T1110 Brute Force (rate per source IP).
• Windows Security 4720/4732 → T1098 Account Manipulation.
• Windows Security 4768/4769 → T1558 Kerberoasting (look for 0x17 RC4 ticket encryption).
• Windows Security 4688 → T1059 command execution (needs auditing enabled).

For continuous coverage tracking: load your Sigma rules into ATT&CK Navigator as a layer; overlay detections (red/green) per technique. The result is a coverage matrix that shows gaps (no green = no detection).

MITRE ATT&CK T1195.002 — Supply Chain Compromise: Compromise Software Supply Chain (SolarWinds; canonical SolarWinds report uses this technique ID).

MITRE ATT&CK T1606.001 — Forge Web Credentials: SAML Tokens (Golden SAML; the SolarWinds post-pivot technique).

MITRE ATT&CK T1078 — Valid Accounts (Colonial Pipeline; reused VPN credential).

MITRE ATT&CK T1486 — Data Encrypted for Impact (DarkSide, LockBit, BlackCat, Conti ransomware).

Wazuh rule 920 / 87100 — Mimikatz signature (matched via Sysmon EID 10 process access of lsass.exe) [verify — custom rule needed].

Wazuh rule 87200 — wevtutil cl (Windows event log clear; T1070.001) [verify].

Evasion Techniques

Living-off-the-land (LotL) — using only built-in binaries (cmd.exe, powershell.exe, wmic.exe, certutil.exe, bitsadmin.exe, mshta.exe) so the technique ID is the same as a legitimate activity. Detection shifts from signature to behavior — for example, “powershell.exe spawned by w3wp.exe” is anomalous even though the powershell itself is benign. ATT&CK T1218 System Binary Proxy Execution captures this category.

T1070.001 clear logs after-action — clearing Windows event logs is itself a logged event (Security Event ID 1102: “The audit log was cleared”). So the evasion creates a detection opportunity. The same is true on Linux (auditd records the operation that disabled audit). Always alert on log-clearing events.

T1218.011 rundll32.exe — a built-in that can load arbitrary DLLs. Cobalt Strike, Empire, and many C2 frameworks use it. Detection: Sysmon EID 1 with Image=rundll32.exe AND CommandLine containing a non-Microsoft DLL path, or no DLL at all.

T1036 Masquerading — renaming the binary. cmd.exe renamed to svchosts.exe (with one extra s) defeats string-based signatures. Defense: Sysmon EID 1 with OriginalFileName field (the PE manifest field that survives rename) and compare to Image.

T1027.002 Obfuscated Files or Information: Software Packing — UPX, custom packers. Detection: entropy-based scan (Shannon entropy > 7.5 is unusual for a signed binary), or YARA rules on packer stubs.

Evasion	ATT&CK ID	Detection
Living off the land	T1218	Behavior: parent-child anomalies; Sysmon EID 1
Log clearing	T1070.001	Security EID 1102
Binary masquerading	T1036	Sysmon EID 1 OriginalFileName
Software packing	T1027.002	Entropy analysis; YARA on packer stubs
Process hollowing	T1055.012	Sysmon EID 8 + EID 7 (image load mismatch)
DLL side-loading	T1574.002	Sysmon EID 7 (image loaded from non-standard path) + signed-but-unusual

⚠️ What caught me: I was reading a breach report that mapped every action to ATT&CK. The mapping was perfect: every step had a clean T1xxx, every technique matched MITRE’s text. The breach still surprised the customer because the report never asked which control failed at each technique. ATT&CK maps what the attacker did; it does not map what the defender should have had. Lesson: ATT&CK is a vocabulary, not a checklist. A technique without a corresponding control failure is just an inventory; the actionable insight is the gap between “technique executed” and “control that should have fired.”

Lab Practice

VM: Ubuntu 22.04 with Docker (for ATT&CK Navigator and Sigma), a Windows 10 Enterprise with Sysmon (SwiftOnConfig) and a Sigma-rule loader. An AWS sandbox account with CloudTrail enabled.

Objective:

1. Build an ATT&CK Navigator layer for the SolarWinds 2020 intrusion using the techniques listed in the SANS and CISA reports. At least 8 techniques across 6 tactics.
2. Build a Sigma rule for T1003.001 LSASS access via comsvcs.dll MiniDump; convert to Splunk SPL and Elastic Lucene with sigmac; verify on a Windows VM that the alert fires when you trigger it.
3. Map the DarkSide/Colonial Pipeline intrusion to the kill chain (7 stages) and to ATT&CK (techniques per tactic).
4. Load a Sigma rule pack (e.g., Sigma’s rules/windows/) into ATT&CK Navigator and produce a coverage matrix showing your detection gaps.

Expected flag format: flag{navigator_layer_8techniques_sigma_lsass_splunk_solarwinds_kill_chain_mapped_darkside_mapped}.

Detection that should fire: Sysmon EID 10 with TargetImage=lsass.exe; Sigma alert in your SIEM with ATT&CK tag t1003.001; ATT&CK Navigator layer shows green coverage for T1003.001; gaps visible for T1606.001 (Golden SAML) — typically a coverage hole.

Interview Questions

Conceptual: name the 7 Lockheed Martin kill chain stages and the 14 MITRE ATT&CK Enterprise tactics. Where do they align, and where does ATT&CK add coverage the kill chain lacks?

Technical: walk through the SolarWinds 2020 intrusion mapped to ATT&CK. Name at least 5 techniques across at least 4 tactics. Which technique was the unique pivot — the one that turned “supply chain compromise” into “domain-wide compromise”?

Scenario: a customer reports a ransomware incident. You are asked “which ATT&CK techniques are most likely in scope?” List the top 8 techniques you expect, and for each, the data source that would confirm it.

What is the difference between ATT&CK Tactic, Technique, and Sub-technique? Give a concrete example of a Sub-technique whose parent technique is too coarse for a useful detection rule.

Technical: explain why T1070.001 (Clear Windows Event Log) is itself detectable, and describe the specific Windows Security Event ID that fires. Why does this evasion technique create a stronger detection signal than the original action it was trying to hide?

Related Modules

→ F10 (Security Models & Principles) · F11 (Threat Modeling) · R1 (Reconnaissance Fundamentals)