07 — How Attacks Actually Happen — Kill Chain and MITRE ATT&CK

Level: Beginner · Time: ~18 min · Prerequisites: Lesson 6 — Operating System Security Basics

Why this matters

When an incident is closed, the write-up usually says "the attacker got in and moved around". That sentence contains nothing you can act on: it does not name the control that failed, the alert that should have fired, or the fix that would stop the next attempt. Defenders need a shared, precise vocabulary for the stages of an intrusion so that the analyst, the sysadmin, the manager who approves the budget and the vendor you ring at 02:00 are all describing the same thing. Two models supply that vocabulary — the Cyber Kill Chain for telling the story and MITRE ATT&CK for deciding what you can actually detect. With them, "they got in" becomes "they phished a user, ran an encoded script from a scheduled task, dumped credentials and pivoted over SMB", which is a sentence you can defend against.

Click the diagram to open it full size.

The mental model: an intrusion is a journey, not an event

Every intrusion is a sequence of small decisions, each made because the previous one worked. Nobody teleports onto your file server; they arrive one unremarkable step at a time, using what is already in front of them.

Two consequences follow, and they are the entire reason models exist:

Break any link and the attack stops. You do not have to win everywhere. If the email is filtered, nothing downstream happens. If the macro is blocked, the loader never runs. Defence in depth is the deliberate placing of overlapping links (see Lesson 16 — Defence in Depth and Zero Trust).
Each link leaves different evidence. Phishing leaves mail-gateway logs. Execution leaves process telemetry. Lateral movement leaves authentication logs. Monitor only one stage and you are blind to everyone who arrives another way.

Models also make you honest. "We have antivirus" is a claim about one link. "We would see a scheduled task created by a non-admin, and an authentication from an unusual host" is a claim about two more.

The Lockheed Martin Cyber Kill Chain

Seven phases, published by Lockheed Martin in 2011. Read it downwards as the attacker's plan, and right-hand-column as your chances.

Phase	One concrete example	Defensive / detection opportunity
1. Reconnaissance	The attacker scrapes a professional networking site for staff names and pulls your DNS and certificate-transparency records to map hosts.	Detect what is visible: bulked-up failed logins, directory brute force, unusual scanning. Shrink your public footprint and do not publish org charts.
2. Weaponisation	A malicious macro document is built to look like an overdue invoice.	Almost nothing to see — this happens on the attacker's infrastructure. Threat intelligence and user awareness buy time here.
3. Delivery	The document arrives as an email attachment, or a link to a compromised website.	Mail filtering, attachment sandboxing, DMARC enforcement, external-sender banners, web proxy blocking.
4. Exploitation	The user enables macros, or an unpatched internet-facing service is exploited.	Patching, macro and script blocking, EDR behavioural rules, least privilege, application allowlisting.
5. Installation	The loader writes an autostart entry and drops a second-stage payload.	Autostart and file-integrity monitoring, process-creation telemetry with command lines, alerts on new services.
6. Command and Control	The implant beacons to a domain every few minutes over HTTPS or DNS.	Egress filtering, DNS logging, proxy logs, TLS-fingerprint analysis, hunting for regular beacon intervals.
7. Actions on Objectives	Data is archived and uploaded, or files are encrypted.	Data-loss prevention, database audit logs, immutable backups, detection of bulk file modification.

Notice the shape. Phases 1–5 happen before the attacker has a usable foothold; phases 6–7 only matter if the earlier ones succeeded. Most of your cheapest, highest-value controls sit in the middle of that list.

Where the kill chain breaks down

It was written for perimeter defence against a human intruder, and it shows its age:

It assumes a perimeter. An insider never passes through phases 1–3 at all.
It misses the cloud. There is no phase for "the attacker found an open storage bucket" or "a leaked API key was used from a laptop" — nothing was delivered or exploited in the classic sense.
It is linear. Real intrusions loop: credential access enables more discovery, which finds more credentials, which enables better persistence.
It is coarse. "Installation" covers dozens of very different behaviours with very different detections.

That is not a reason to discard it. Keep it for narrative, and add something finer-grained for detection.

MITRE ATT&CK: one vocabulary for every intrusion

ATT&CK — Adversarial Tactics, Techniques and Common Knowledge — is a free, publicly maintained knowledge base of behaviours observed in real intrusions, built from public threat reporting. It is not a list of vulnerabilities and it is not a tool. It describes what an adversary does, independently of what they used to do it.

Tactics, techniques, sub-techniques, procedures

Term	What it is	Example	Granularity
Tactic	the attacker's goal at a stage — the "why"	Credential Access	14 in the Enterprise matrix
Technique	a way to achieve that goal — the "how"	OS Credential Dumping, ID T1003	hundreds; each has a stable ID
Sub-technique	a specific method inside a technique	LSASS Memory, T1003.001	finer still
Procedure	what one named group actually did	a tracked group using a specific commercial tool in a 2021 campaign	unique per group, changes constantly

Learn the tactics so you can communicate with other people. Learn the two dozen techniques relevant to your estate so you can detect. Never try to memorise the whole matrix.

The 14 enterprise tactics, in order

#	Tactic	The attacker's goal
1	Reconnaissance	learn about you before touching you
2	Resource Development	build or buy the infrastructure and accounts they need
3	Initial Access	get a first foothold
4	Execution	run their code on your host
5	Persistence	survive a reboot, a logout or a password change
6	Privilege Escalation	gain higher rights than they started with
7	Defense Evasion	avoid being seen (spelled Defence Evasion in British English)
8	Credential Access	steal accounts and secrets
9	Discovery	learn what is around them inside your network
10	Lateral Movement	reach more valuable systems
11	Collection	gather the data they came for
12	Command and Control	talk to their own infrastructure from inside your network
13	Exfiltration	get the data out
14	Impact	destroy, encrypt or publish

The matrix is versioned and occasionally renames a tactic, so check the live page rather than trusting a printout. The order is the part that matters: it is the same journey as the kill chain, divided into behaviours you can write a detection for.

[!TIP] Treat ATT&CK as a coverage checklist, not a reading list. For each tactic ask one question: "if this happened here tomorrow, what would tell me?" If the answer is "nothing", you have found a gap worth more than another week of alert tuning.

How to navigate it without memorising it

Start from a technique you already care about, not from the top of the matrix.
Use the group and software pages: pick the group currently targeting your sector and read the techniques listed against it. That is a curated, short list.
Use the detection and mitigation mappings on each technique page — they name the log sources needed to see it.
Use the free ATT&CK Navigator to colour the matrix with the techniques you can detect. The uncoloured cells are your blind spots, visible in one screenshot.

TTPs versus IOCs: the pyramid of pain

An indicator of compromise (IOC) is something observable: a file hash, an IP address, a domain name. A TTP is a tactic, technique or procedure — a behaviour. The pyramid of pain explains why TTPs are worth more than indicators.

Level	Example	Cost for the attacker to change	Value for you
Hashes	SHA-256 of the malware file	trivial — one byte changed at build	near-zero; dies at the next compile
IP addresses	203.0.113.9	easy — rent another server	low; rotated hourly
Domain names	an invoice-themed lookalike domain	modest — register another	low to moderate
Network and host artefacts	a specific user agent string, a file path	moderate — rebuild tooling	good, if you write behavioural rules
Tools	a named loader or remote-access framework	real cost — retrain operators, rebuild	strong; tools change slowly
TTPs	phishing, scheduled-task persistence, lateral movement with valid accounts	painful — must change how they work	strongest; the detection survives re-tooling

IOCs remain useful: they are cheap to block and catch the low-effort majority. But a detection strategy built only on them must be rebuilt every week. Detections written against behaviour keep working when the attacker changes tools.

The Diamond Model, briefly

The Diamond Model describes every intrusion as four connected vertices.

Vertex	Question it answers	Example
Adversary	who	a ransomware affiliate
Capability	what tools and techniques	a loader plus a remote-access tool
Infrastructure	what they run it on	a rented server, a compromised website, a cloud account
Victim	against whom	a manufacturer in your region

Its practical gift is the pivot: find one vertex and ask what else shares it. Same infrastructure but a different victim? Two incidents are one campaign, and a warning sent to your peers is worth more than a firewall rule. Same capability, different infrastructure? Probably the same tooling reused by different actors. That is how one incident becomes sector-wide warning.

Who is attacking you, and why

Not all attackers are equal, and the right response depends entirely on which one you face.

Actor	Motivation	Capability	Typical target	Typical impact
Script kiddies	curiosity, bragging rights	very low — copied tools, no patience	anything exposed and unpatched	defacement, minor data theft
Cybercriminals	money	moderate to high, well organised	SMBs, e-commerce, anyone holding data or money	fraud, extortion
Initial access brokers	sell a foothold	high, focused only on getting in	whoever they can phish or scan into	someone else's problem becomes yours
Ransomware affiliates	a share of the ransom	high, efficient, repeatable	whoever is easiest to encrypt	outage, extortion, theft of data
Hacktivists	ideology, publicity	low to moderate	visible, symbolic or politically relevant organisations	defacement, denial of service, leaks
Insiders	grievance, money, carelessness	already has access and context	their own employer	data theft, sabotage, accidental breach
Organised crime	large-scale profit	high, specialised teams	finance, retail, healthcare	persistent fraud, sale of stolen data
Nation-state / APT	espionage, disruption, long-term access	very high, patient, well resourced	government, critical infrastructure, IP-rich firms	quiet, long-dwell compromise

The practical reading: against opportunists, good hygiene is enough. Against ransomware, backups and segmentation decide the outcome. Against a nation-state you are buying time and visibility, not immunity. That is why "what is your threat model?" is the first question in any security conversation — you cannot resource every control equally.

One intrusion, end to end

Below is a composite account of a very common intrusion. Nothing here is novel; the lesson is how ordinary each step looks in isolation.

Step	What happened	ATT&CK tactic	Two most useful detection sources
1	A finance user received an invoice-themed email with a compressed attachment from a lookalike domain.	Initial Access — T1566 Phishing	mail-gateway logs; DMARC and authentication results
2	The user extracted and opened the document; a macro launched a command interpreter with an encoded argument.	Execution — T1059.001 PowerShell	EDR process telemetry; process-creation events including command lines
3	An autostart entry was created so the payload runs at every login.	Persistence — T1547	endpoint autostart monitoring; registry-change auditing
4	A credential-dumping tool read secrets from process memory.	Credential Access — T1003	EDR alerting on sensitive-process access by non-security tools; privilege-use events
5	The attacker enumerated users, groups and other hosts.	Discovery — T1087, T1018	directory-service query auditing; query-volume anomalies from one host
6	Stolen credentials opened file-sharing sessions to other workstations.	Lateral Movement — T1021	authentication logs showing unusual sources; internal network flow data
7	Files were gathered from a shared drive and archived.	Collection — T1005	file-access auditing on shares; alerting on bulk reads
8	The archive was uploaded to a cloud storage service the company legitimately uses.	Exfiltration — T1041	proxy logs; egress volume baselines
9	Files were encrypted and recovery paths attacked.	Impact — T1486	mass file-modification detection; backup-console alerts for deletion

Read column three downwards and you have the ATT&CK journey. Read column four and you have a monitoring plan: a handful of log sources, each doing one job. Cover any single one of those columns and the intrusion looks very different.

Using ATT&CK as a defender

Two exercises, both cheap and repeatable:

Map what you already have. List your existing alerts and detections, and tag each with the tactic it covers. Then look at the matrix and find the tactics with nothing under them. In most small organisations the gaps cluster in Discovery, Collection and Exfiltration.
Prioritise by what your sector actually sees. You do not need equal coverage across all 14 tactics. Read incident reports for your industry — regulators, sector bodies and national cyber agencies publish them — count which tactics recur, and weight your effort accordingly. Phishing-to-ransomware is the modal story for most small firms; if that is you, Initial Access, Execution, Persistence and Impact deserve the first 80% of your attention. Lesson 44 covers building the detection side of this for real.

[!IMPORTANT] A model is a map, not the territory. Attackers are not obliged to follow the kill chain in order, and ATT&CK documents what has been observed, not everything possible. Use both to organise your thinking and to talk to other people — never to conclude that an intrusion which does not fit the model is not happening.

Attack it / Defend it

The attack	How it works	The control that stops it
Phishing delivery	an email or link recruits a human as the entry point	mail filtering, DMARC enforcement, attachment sandboxing, training, phishing-resistant MFA
Encoded script execution	a macro or launcher runs an obfuscated command interpreter	macro and script blocking, application allowlisting, command-line telemetry
Autostart persistence	a Run key, scheduled task or service restarts the payload	autostart monitoring, EDR rules, restricting who may create services and scheduled tasks
Credential dumping	secrets are read from memory or the credential store	credential-protection features, removing local admin, EDR on process access, tiered admin
Internal discovery	users, groups and hosts are enumerated to plan the next move	log directory queries, trim over-permissive read rights, alert on enumeration volume
Lateral movement over SMB	stolen credentials are reused against other hosts	segmentation, no workstation-to-workstation file sharing, credential hygiene, managed local admin passwords
Beaconing command and control	periodic outbound connections to attacker infrastructure	egress filtering with allowlists, DNS logging, TLS fingerprinting, beacon-interval hunting
Data exfiltration	the archive leaves over an already-permitted channel	data-loss prevention, egress baselines, proxy logging, blocking unapproved cloud storage
Ransomware impact	data encrypted and recovery paths attacked	immutable offline tested backups, least privilege, segmentation, mass-file-change detection
The detection gap itself	the intrusion proceeds with no alert at any stage	ATT&CK-mapped coverage reviews, purple-team exercises, log-source completeness checks

Key takeaways

An intrusion is a sequence, not an event. Name the stage before you argue about the fix, and you will almost always find a cheaper place to break the chain than the place it was noticed.
The kill chain tells the story; ATT&CK tells you what to detect. Use the first with humans, the second with engineering.
Tactics are goals, techniques are methods, procedures belong to a group. Memorise the 14 tactics, look the rest up.
Behaviour beats indicators. Hashes last hours, IP addresses last days, TTPs last for years.
Who is attacking you changes what "good enough" means. Backups answer ransomware, hygiene answers opportunists, and nothing answers an APT completely.

Check yourself

A colleague reports "we were breached through a vulnerability". Which kill-chain phases does that sentence ignore, and why does the omission change the fix?
Give one plausible attacker behaviour in your own environment for each of these tactics: Initial Access, Persistence, Credential Access, Exfiltration.
Your threat-intelligence feed just sent you 400 new file hashes. What can you do with them today, and what will they be worth next month?
Two incidents at two different companies share the same infrastructure but nothing else. What does the Diamond Model let you conclude?
Name two tactics where a small organisation typically has no detection at all, and one cheap log source that would start to cover them.