Resources
- General Knowledge
- Lockheed Martin’s cyberkill chain : https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
- The Unified kill chain : https://www.unifiedkillchain.com/assets/The-Unified-Kill-Chain.pdf
- ATT&CK : https://attack.mitre.org/
- The Pyramid of Pain : https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html
- Prefer To Read
- Case Studies
Chaet Sheet
- CastelDefender : https://publish.obsidian.md/castledefender/Cybersecurity/Blog/Guides/Building+a+SIEM/Building+a+SIEM+-+1+-+Understanding+the+Parts
Tools
- Miter Attack Navigator : https://mitre-attack.github.io/attack-navigator/
Notes
The Unified Kill Chain (UKC)
The Concept: The UKC integrates Lockheed Martin’s Cyber Kill Chain® and MITRE’s ATT&CK™ to describe the end-to-end tactical progression of modern cyber attacks by APTs and ransomware groups.
Core Principle (Assume Breach): Attacks are phased but NOT strictly deterministic. Attackers can bypass phases or loop back. Defenders must focus on layered strategies and securing “choke points” rather than just defending the perimeter.
1. IN (Breaching the Perimeter)
The Goal: Gain an initial foothold. If a tactic fails, the attacker loops back to try different techniques until they are “In”.
- Reconnaissance: Researching and selecting targets.
- Resource Development: Setting up the required infrastructure (e.g., weaponizing objects).
- Delivery: Transmitting the weaponized object to the target.
- Social Engineering: Manipulating people into performing unsafe actions.
- Exploitation: Exploiting vulnerabilities to achieve outcomes like code execution.
- Persistence: Actions to maintain persistent access to a compromised system.
- Defense Evasion: Techniques to avoid detection.
- Command & Control: Establishing communication with compromised systems.
2. THROUGH (Navigating the Network)
The Goal: Hack through the internal network. Attackers use compromised systems to pivot, repeating this cycle in new network segments until they reach their target assets.
- Pivoting: Tunneling traffic through a controlled system to access others.
- Discovery: Gathering knowledge about a system and its network.
- Privilege Escalation: Obtaining higher permissions.
- Execution: Running attacker-controlled code.
- Credential Access: Gaining control over system or domain credentials.
- Lateral Movement: Moving horizontally to access other systems.
3. OUT (Achieving Objectives)
The Goal: Execute the final strategic mission. This is an iterative loop performed until the strategic goals are met.
- Collection: Gathering targeted data prior to exfiltration.
- Exfiltration: Removing data from the target network.
- Impact: Manipulating, interrupting, or destroying systems/data (e.g., sabotage, ransomware encryption).
- Objectives: Achieving the overarching socio-technical, strategic goals of the attack.
Unified Kill Chain vs. MITRE ATT&CK
The Concept: Mapping the 18 strategic phases of the UKC directly to the 14 operational tactics of the MITRE ATT&CK Enterprise matrix.
Macro Stage (The Goal) Unified Kill Chain (Strategic Phase) MITRE ATT&CK (Technical Tactic) ** 1. IN**
(Breaching the Perimeter)Reconnaissance Reconnaissance Resource Development Resource Development Delivery Initial Access Social Engineering Initial Access Exploitation Initial Access / Execution Persistence Persistence Defense Evasion Defense Evasion Command & Control Command and Control ** 2. THROUGH**
(Navigating the Network)Pivoting (Covered under C2 & Lateral Movement) Discovery Discovery Privilege Escalation Privilege Escalation Execution Execution Credential Access Credential Access Lateral Movement Lateral Movement ** 3. OUT**
(Achieving Objectives)Collection Collection Exfiltration Exfiltration Impact Impact Objectives (Strategic target - No direct ATT&CK tactic)