How attackers think: the kill chain and MITRE ATT&CK
Lesson 3 of 6
3How attackers think: the kill chain and MITRE ATT&CK
The big pictureA burglar does not burst in out of nowhere. First they watch the street and learn when you leave, then they get their tools ready, then they try the door or a window, and once inside they try to stay unnoticed, then take what they want. Each step is a chance for you: a camera that sees them watching, a good lock on the door, an alarm once they are inside.
What the picture shows: The attacker (the red dot) advances stage by stage until it reaches exploitation and finds a patched machine and an account with MFA. The chain is broken, so no installation, no control, no ransom.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Think of an attack as a story with chapters: spying, preparing, breaking in, hiding, stealing. The defender does not need to stop the whole story; tearing out one chapter stops the rest. And the earlier the chapter, the smaller the loss.
The Lockheed Martin Cyber Kill Chain: seven linear stages (reconnaissance, weaponization, delivery, exploitation, installation, C2, actions on objectives), great for teaching the overall logic. MITRE ATT&CK is an open knowledge base built from real attacks: tactics (why), techniques and sub-techniques (how), and the procedures of specific groups. It is used to measure detection coverage, draw heat maps and emulate adversaries. Enterprise v20 has 15 tactics, with Stealth and Defense Impairment replacing Defense Evasion.
Before You Start
🌐The 2026 threat landscape
You know the kinds of attackers and the common attacks.
🛰️Ports and VPNs
From the networking track, to follow "exposed service" and "outbound connection".
The Core Idea
1The kill chain: seven stages
Lockheed Martin split an attack into seven stages in order. The defensive idea is simple and strong: stopping the attacker at one stage makes the whole attack fail. Try it yourself: pick a stage to see what the attacker does and how the defender answers.
Drill: attack and defence at every stage
The scenario: a ransomware gang targets a mid-sized company. Pick a stage to see what the attacker does there, and how the defender spots and stops them.
The defender's idea: stopping the attacker at any one stage makes the whole attack fail, and the earlier you stop them the smaller the loss. Press a stage to isolate it.
The attacker at «Reconnaissance»
Collects the names of finance staff from LinkedIn and scans the internet for the company's exposed services, such as its VPN gateway.
The defender: how to spot and stop it
Publish less, watch the external attack surface, and spot the scans in the firewall logs.
ATT&CK tactics: Reconnaissance
The attacker at «Weaponization»
Buys leaked credentials, prepares a malicious file, or gets an exploit for a known flaw in the VPN model in use.
The defender: how to spot and stop it
This happens outside your network; the best defence is threat intelligence and patching the actually exploited flaws first.
ATT&CK tactics: Resource Development
The attacker at «Delivery»
Sends a phishing email titled "Overdue invoice" to a finance employee, or tries the stolen credentials on the VPN.
The defender: how to spot and stop it
Mail filtering with SPF, DKIM and DMARC, staff training, and phishing-resistant MFA on the VPN.
ATT&CK tactics: Initial Access
The attacker at «Exploitation»
The employee opens the attachment and code runs, or the attacker exploits the flaw in an unpatched VPN device.
The defender: how to spot and stop it
Fast patching, blocking macros from the internet, EDR spotting odd behaviour, and least privilege for users.
ATT&CK tactics: Execution
The attacker at «Installation»
Plants a backdoor, adds a scheduled task or a new account to survive a restart, and raises their privileges.
The defender: how to spot and stop it
EDR alerts on persistence, application allow lists, and watching new accounts and high privileges.
ATT&CK tactics: PersistencePrivilege EscalationStealth
The attacker at «Command & control»
The infected machine calls the attacker's server over HTTPS; the attacker moves sideways and steals an admin's credentials.
The defender: how to spot and stop it
Filter outbound traffic and DNS, monitor the network, segment it, and guard admin accounts separately.
ATT&CK tactics: Command and ControlLateral MovementCredential Access
The attacker at «Actions on objectives»
Pulls out the sensitive data first, then deletes the backups, encrypts the servers and demands a ransom (double extortion).
The defender: how to spot and stop it
Offline, tested backups, detecting mass encryption, data loss prevention (DLP), and a ready response plan.
ATT&CK tactics: ExfiltrationImpactDefense Impairment
2MITRE ATT&CK: tactics and techniques
The kill chain is linear and simplified, while real attacks branch and loop back. So MITRE built an open knowledge base from real attacks. A tactic is the attacker's goal at that moment (why): for example initial access or credential access. A technique is how they get there: for example a phishing attachment, or dumping the login system's memory.
You will still meet the old name Defense Evasion in many books and articles, so know both.
Defenders use ATT&CK to ask: "if the attacker used this technique, would we catch it?" and draw a coloured map of what they cover and what they miss. Testers use it to emulate a specific group of attackers.
3Think like an attacker to defend better
The best question a defender asks: "if I were the attacker, where would I start?". The answer is usually boring: an old VPN gateway, a former employee's account nobody disabled, or a default password. This is the attack surface: everything an attacker can touch.
Worked example
The task: an alert arrives: "an employee's machine calls an unknown address over HTTPS every 60 seconds, and a new local admin account appeared on it". Which stage of the chain are you at, and what is your move?
The answer: regular calls to an unknown address are the sign of command and control, and the new account is a sign of installation (persistence). So the attacker is past exploitation. The move: isolate the machine, block the address at the firewall and DNS, disable the new account, and look for the same calls on other machines before they reach their objective.
Myth vs Reality
| Myth | Reality |
|---|---|
| An attack happens in minutes and cannot be stopped. | Most attacks take days or weeks across stages, and each stage leaves a trace you can catch. |
| ATT&CK is a list for analysts to memorise. | It is a shared language and a coverage tool; you look things up when needed rather than memorising it. |
Where you meet it at work
🖥️SOC analyst
Maps every alert to a tactic to know how far the attacker has got.
🎯Pen tester
Plans the test as stages and writes the report in ATT&CK terms.
Test your understanding
Which ATT&CK tactic describes taking data out of the network?
Collection gathers it inside the network; Exfiltration moves it out to the attacker.
What is the difference between a tactic and a technique in ATT&CK?
Example: initial access is a tactic; a phishing attachment is a technique to achieve it.
In ATT&CK v20, what replaced Defense Evasion?
It was split in two: staying hidden, and impairing defensive tools.
What is the first stage of the Lockheed Martin kill chain?
The attacker gathers information before anything else.
In ATT&CK, how does a tactic differ from a technique?
Example: Credential Access is a tactic, Brute Force a technique.
Breaking the chain at any stage means:
The earlier you break it, the smaller the damage.
Quick review cards
Check Your Understanding
Why does breaking one link suffice for the defender?
Because each stage depends on the one before; if exploitation fails there is no installation, control or objective.
Why does weaponization rarely show in your logs?
Because it happens on the attacker's side: they prepare their tools on their own machines before touching your network.
Why does a defender think like an attacker?
To know where the blow will land first, so controls and monitoring sit on the expected path, not spread evenly everywhere.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.