⚔️ Cyber Kill Chain Guide - Anatomy of Attack
Six chapters on modelling of attacks in international practice: Lockheed Martin Kill Chain (Hutchins, Cloppert, Amin 2011), MITRE ATT&CK 14 tactics, Unified Kill Chain (Paul Paul 2022), Diamond Model, D3FEND defense matrix and link to NIS2 Article 23 incident reporting to NKDC/CERT.LV. Examples are fictional, intended for teaching.
Basis for attack modelling
Kill Chain principle - breaking one stage, mission fails
History
The Cyber Kill Chain model was formalized in 2011 by Lockheed Martin researchers Hutchins, Cloppert and Amin. Model adapted from military 'F2T2EA' kit chain (Find, Fix, Track, Target, Engage, Assess) in the US Air Force.
Basic principle
The attack is a sequential chain - every next phase needs a previous result. By stopping one stage, the whole attack fails. This means that the defenders do not have to be perfect in all phases - it is enough to break one.
Application
Three modeling, threat intelligence (TI), detection engineering, incident response plans, security gap analysis, purple team simulations.
Restrictions
Model created for APT/network intrusion analysis. Less suited for internal threats (insiders), supply chain attacks, cloud-native attacks and compromised SaaS sessions where 'supply' and 'explosion' are foggy.
Lockheed Martin 7 Phases
From intelligence to objectives - each phase with protection
Application
This table serves as a detection engineering 'card' - each phase needs to know what artifact or signal indicates how it is going, so that SOC can establish the appropriate rule.
Reference
Lockheed Martin "Cyber Kill Chain' (2011) · Hutchins, Cloppert, Amin - "Intelligence-Driven Computer Network Defense Informed by Analysis of Additional Campaigns and Intrusion Kill Chains'.
Lacmus test
Can your SOC reveal at least one artifact in each of the seven phases? If any phase is 'empty' - there's a blind strip that an attacker can use without respect.
MITRE ATT&CK - tactics, techniques, procedures
14 tactics - detailed fascinating behavior classification
Difference from LM
The LM Kill Chain has a linear chain (after → how). ATT&CK is a granular tactical catalogue (which → as → specifically). The attacker can stop, return, repeat phases - so 14 tactics are not necessarily consecutive.
Reference
MITRE ATT&CK Enterprise (attack.mitre.org) · First published in 2013, formally as ATT&CK Matrix 2015 · Updated every 6 months.
Practical use
ATT&CK Navigator - map which techniques your SOC covers with detection. Empty cells = blind strips. Purple team simulates procedures to verify detection.
Volume trap
Covering all ~400 sub-technics is a marathon work. Start from APT groups that target your sector (e.g. FIN7 for finance, Lazarus for energy) rather than all at once.
Unified Kill Chain - Paul Paul 2017/2022
3 phases of 18 phases - merging LM + ATT&CK
Why 18 phases?
LM 7 phases are too simplified for a modern attack - especially 'after access' activities. UKC divides them into stage B and clearly separates social engineering as a separate phase.
Reference
Paul Paul - Unified Kill Chain (Magical Work, Cybersec Academy, 2017. Updated 2022) · unifiedkillchain.com.
Application
For analysis of modern APT/ransomware operations - where the attacker returns several times between stages A and B (e.g. executes the 2.3, 4. intelligence iteration after each lateral movement).
Complexity
18 phases are more difficult to communicate to management than LM 7 phases. UKC is better suited for technical analysis, LM for presentations and risk communication.
Protection strategy
Courses of Action matrix + Diamond Model + MITRE D3FEND
Courses of Action
6 types of action have no choice - an advocacy strategy ideally covers several stages so that the attacker has several potentially cut-off points.
Diamond Model
Threat intel analysis framework - each incident as a 4-hour ratio. When discovering one corner, you can find the rest. Perfect for tracking campaigns.
D3FEND
MITRE D3FEND (2021) - catalogue of defence activities according to ATT&CK techniques. D3fend.mitre.org - shows for each ATT&CK technique which D3FEND operations neutralise it.
Legal notice
In the 'Destroy' phase carefully - 'hack back' (attack back) is mostly illegal. Authorised: takeown with law enforcement, C2 synkhole, cooperation with CSIRT (Latvia: CERT.LV).
Article 23 NIS2 and Latvian context
Incident reporting to the NKDC - 24h / 72h / 1 month
Who should report?
The NKDC shall receive Article 23 reports as a competent authority. CERT.LV - as CSIRT - technical assistance and exchange of IoC. The major incidents must be reported to both NKDC formally, CERT.LV operationally.
Reference
Directive (EU) 2022/2555 Article 23 · National Cybersecurity Act (LV, 2024) · Cabinet rules (preparation) for material/significant categories of entities.
Practical link with Kill Chain
When the attacker reaches phase 6-7 (C2, Actions) - usually a 'major incident' by definition of NIS2. T0 = time of detection and not the moment of initiation - therefore early detection = more time for response.
Penalties
NIS2 provides for administrative penalties of up to 10 million euros or 2% of the global annual turnover (relevant subjects) and 7 million / 1.4% (important). Non-notification is an independent violation - even if the incident itself is not the result of a crime.
Early warning
Initial notification to the NKDC of a significant incident, whether it is unlawful/mistakeable or affecting cross-border services.
Incident notification
A more detailed report to the NKDC with an initial assessment, impact volume, compromise indicators (IoC) and counter-measures taken.
Final report
Full final report - detailed description of the incident, causes, impacts, counter-measures taken and planned, lessons for the future.