Attacker movement: kill chain and ATT&CK
How intrusions actually unfold, the MITRE ATT&CK vocabulary that lets engineers and analysts talk precisely, how to map coverage and find gaps, and how to use both mid-incident to predict the attacker's next move.
01How an intrusion unfolds
- Narrate a typical intrusion stage by stage
- Use tactics, techniques, sub-techniques and procedures precisely
- Map your telemetry to techniques and find coverage gaps
- Use the chain mid-incident to predict and get ahead of the next step
- THREAT
- Live flow
Real intrusions are not tidy. Attackers loop: credential access on the first host, lateral movement, credential access again with better privileges. But the chain is still the best way to tell the story to a room, because everyone can follow "they got in, they ran code, they stayed, they moved, they took".
"I'd narrate it as a chain: foothold, execution, persistence, movement, objective. Then I'd use ATT&CK to be precise about which techniques we can see and which we can't."
02ATT&CK vocabulary
ATT&CK is a knowledge base of observed adversary behaviour. Tactics are the why (the goal: persistence). Techniques are the how (scheduled task, T1053). Sub-techniques are a specific variant (T1053.005, Windows Task Scheduler). Procedures are what a named group actually did (a specific command line).
| ATT&CK tactic | Typical technique | Telemetry that sees it |
|---|---|---|
| Initial access | Phishing (T1566), exploit public app (T1190) | Mail gateway, WAF, auth logs |
| Execution | PowerShell (T1059.001), Office macro | EDR process events with command line |
| Persistence | Scheduled task (T1053.005), OAuth app consent, new MFA method | EDR, IdP app and audit logs |
| Credential access | LSASS dump (T1003.001), Kerberoasting (T1558.003) | EDR memory access events, DC 4769 |
| Lateral movement | RDP, SMB admin shares, remote services (T1021) | Auth logs (4624 type 3/10), network flow, EDR |
| Collection | Email forwarding rule (T1114.003) | M365 audit log |
| Exfiltration | Exfiltration to cloud storage (T1567.002) | Egress proxy, DLP, cloud audit |
Hashes and IPs change in minutes. Techniques change slowly. A detection on "Office app spawns a script interpreter" survives a hundred new payloads; a hash block survives one.
"The attacker created a scheduled task named `GoogleUpdateCheck` running `rundll32` on a DLL in AppData." At which ATT&CK level is this description?
03Mapping coverage and finding gaps
ATT&CK is not a checklist to complete. It is a map: lay your log sources and detections over it and the blank regions are your gaps. A common finding: strong initial-access coverage (mail, WAF), nothing on persistence via OAuth consents or on exfiltration through sanctioned cloud storage.
title: Office application spawns script interpreter
id: 6c1e3d6a-office-child-script
status: stable
logsource: { product: windows, category: process_creation }
detection:
parent:
ParentImage|endswith: ['\WINWORD.EXE', '\EXCEL.EXE', '\POWERPNT.EXE', '\OUTLOOK.EXE']
child:
Image|endswith: ['\powershell.exe', '\cmd.exe', '\wscript.exe', '\mshta.exe', '\rundll32.exe']
condition: parent and child
level: high
tags: [attack.execution, attack.t1059.001, attack.initial_access, attack.t1566.001]Tag every detection with its technique IDs at write time. Coverage then becomes a query over your rule repository rather than a spreadsheet someone updates once a year.
A green cell means one rule exists, not that the technique is detected. Rate each cell by whether the rule is tested (emulated recently), tuned (alert volume is workable) and has a runbook.
04Using it mid-incident
Once you have placed one event on the chain, ask what must have happened before it and what usually comes next. A confirmed credential dump means lateral movement is likely within hours, so you hunt 4624 type 3 and 10 logons from that host and pre-emptively reset the accounts that were logged on there.
| You found | Look backwards for | Get ahead of |
|---|---|---|
| Encoded PowerShell from Excel | The phishing email and other recipients | Persistence (run keys, tasks) and C2 beacons |
| LSASS access by an unknown process | How that process got there | Lateral movement with the harvested accounts |
| New inbox forwarding rule | The sign-in that created it (IP, MFA, session) | Internal phishing from the mailbox, payment fraud |
| Large upload to personal cloud | Staging: archives created, files collected | Ransomware or extortion note; legal and comms |
"Once I have one confirmed technique, I use the chain in both directions: backwards to find initial access so I can scope who else was hit, forwards to predict the next step and put a control there before they reach it."
Q1Kill chain or ATT&CK?+
Kill chain tells the story in order; ATT&CK gives the precise vocabulary and is not strictly ordered. Use the chain to explain, ATT&CK to measure.
Q2How do engineers use this?+
When designing a system, walk the chain against it: how would someone get in, run code, persist, move and leave? Each answer is a control or a log you should emit.
Q3What is the pyramid of pain?+
A ranking of indicators by how much it costs the attacker when you detect them: hashes and IPs are trivial to change, tools are harder, behaviours (TTPs) are hardest. Push detections up the pyramid.
Your telemetry has mail gateway, WAF and EDR but no cloud audit or egress proxy logs. Biggest blind spot?