The kill chain and MITRE ATT&CK

An intrusion is a sequence of actions, and everyone involved (attacker, defender, report reader) benefits from a common vocabulary for those actions. Two frameworks dominate. They are complementary, not competing: the kill chain describes the arc of an attack, and MITRE ATT&CK catalogues the techniques used at each stage.

The Cyber Kill Chain: the arc

Lockheed Martin's Cyber Kill Chain models an intrusion as seven ordered stages:

1. Reconnaissance: research the target.
2. Weaponisation: build the payload, for example a malicious document.
3. Delivery: get it to the target (phish, USB, exposed service).
4. Exploitation: trigger the vulnerability.
5. Installation: establish a foothold.
6. Command and Control (C2): establish remote control.
7. Actions on Objectives: do the actual damage (exfiltration, ransomware).

The value of the linear model is interruption: a defender only has to break the chain at one link to stop the attack. It maps cleanly onto defense in depth, where each layer is a chance to break a link.

Its limitation is that real intrusions are not tidy lines. Attackers loop, they recon, move, escalate, and recon again. That is where ATT&CK comes in.

MITRE ATT&CK: the catalogue

ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a large, community-maintained knowledge base of real-world adversary behaviour. It is structured as a matrix:

• Tactics: the attacker's goal at a moment (the "why"), such as Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.
• Techniques: how they achieve a tactic (the "what"). Under Credential Access, for example, T1557 Adversary-in-the-Middle, T1110 Brute Force, and T1003 OS Credential Dumping.
• Sub-techniques: specific variants of a technique.

Crucially, ATT&CK is overwhelmingly about post-compromise behaviour, the interior of the assumed-breach world. That is why it is the lingua franca of modern offensive and detection engineering.

Kill chain versus ATT&CK: when to reach for which

A good report uses both: the kill chain (or a simple attack-path diagram) to tell the story to executives, and ATT&CK technique IDs on individual findings so blue teams can map them straight to detections.

Using AI to speak the defender's language

Tagging findings with ATT&CK techniques is a natural place to lean on an AI assistant. Given a description of what you did (poisoned a name-resolution response, dumped a credential store), a model can propose the matching tactic and technique and draft the attack narrative that stitches your evidence into a story. That saves real time on a report.

The catch is that models invent technique IDs. An AI will happily produce a plausible-looking "T1557.004" that does not exist, or attach a real ID to the wrong behaviour. Treat every suggested identifier as a lookup to verify against the official ATT&CK matrix, not a fact. Let AI draft the mapping and the narrative, then confirm each technique ID yourself so the report a blue team relies on is accurate.

Related reading

• Defense in depth: breaking links in the chain.
• Risk, impact and CVSS: scoring what you found.