analyzing-cyber-kill-chain

1# Analyzing Cyber Kill Chain
2 
3## When to Use
4 
5Use this skill when:
6- Conducting post-incident analysis to determine how far an adversary progressed through an attack sequence
7- Designing layered defensive controls with the goal of interrupting attacks at the earliest possible phase
8- Producing threat intelligence reports that communicate attack progression to non-technical stakeholders
9 
10**Do not use** this skill as a standalone framework — combine with MITRE ATT&CK for technique-level granularity beyond what the 7-phase kill chain provides.
11 
12## Prerequisites
13 
14- Complete incident timeline with forensic artifacts mapped to specific adversary actions
15- MITRE ATT&CK Enterprise matrix for technique-level mapping within each kill chain phase
16- Access to threat intelligence on the suspected adversary group's typical kill chain progression
17- Post-incident report or IR timeline from responding team
18 
19## Workflow
20 
21### Step 1: Map Observed Actions to Kill Chain Phases
22 
23The Lockheed Martin Cyber Kill Chain consists of seven phases. Map all observed adversary actions:
24 
25**Phase 1 - Reconnaissance**: Adversary gathers target information before attack.
26- Indicators: DNS queries from adversary IP, LinkedIn scraping, job posting analysis, Shodan scans of organization infrastructure
27 
28**Phase 2 - Weaponization**: Adversary creates attack tool (malware + exploit).
29- Indicators: Malware compilation timestamps, exploit document metadata, builder artifacts in malware samples
30…