MITRE ATT&CK Tactics Mapped to Cyber Kill Chain

Overview

This mapping correlates the 14 MITRE ATT&CK tactics with the 7 phases of the Lockheed Martin Cyber Kill Chain, providing a strategic view of adversary objectives throughout the attack lifecycle. Unlike techniques (which describe “how”), tactics represent the “why” behind adversary actions at each phase.

---

Kill Chain Phase 1: Reconnaissance

Phase Objective: Research, identify, and select targets

Primary MITRE Tactic

Reconnaissance (TA0043)

• Tactical Goal: Gather information to plan future adversary operations
• Scope: Information gathering about the target organization, infrastructure, and personnel
• Timeline: Weeks to months before initial access
• Adversary Mindset: “What can I learn about this target?”

Key Activities:

• Passive information gathering
• Social media research
• Technical infrastructure mapping
• Employee identification
• Security posture assessment

Detection Focus:

• External reconnaissance signatures
• Unusual OSINT queries
• Suspicious social media activity
• Scanning activity against public assets

---

Kill Chain Phase 2: Weaponization

Phase Objective: Create and prepare attack tools and infrastructure

Primary MITRE Tactic

Resource Development (TA0042)

• Tactical Goal: Establish resources to support operations
• Scope: Creating, purchasing, or stealing capabilities and infrastructure
• Timeline: Days to weeks before delivery
• Adversary Mindset: “What do I need to successfully attack this target?”

Key Activities:

• Malware development or acquisition
• Infrastructure setup (domains, servers)
• Exploit preparation
• Tool customization
• Command and control preparation

Detection Focus:

• Domain registration monitoring
• Malware development indicators
• Infrastructure acquisition patterns
• Dark web marketplace activity

---

Kill Chain Phase 3: Delivery

Phase Objective: Transmit the weapon to the target

Primary MITRE Tactic

Initial Access (TA0001)

• Tactical Goal: Get into the target network
• Scope: First entry point into the victim environment
• Timeline: Minutes to hours
• Adversary Mindset: “How do I get my foot in the door?”

Key Activities:

• Spear-phishing campaigns
• Watering hole attacks
• Supply chain compromises
• Exploitation of public-facing applications
• Physical access attempts

Detection Focus:

• Email security monitoring
• Web application firewalls
• Network perimeter controls
• Endpoint protection systems

---

Kill Chain Phase 4: Exploitation

Phase Objective: Execute code and gain control of systems

Primary MITRE Tactics

Execution (TA0002)

• Tactical Goal: Run malicious code on victim systems
• Scope: Code execution on local or remote systems
• Timeline: Minutes to hours after delivery
• Adversary Mindset: “How do I run my code on their systems?”

Privilege Escalation (TA0004)

• Tactical Goal: Gain higher-level permissions
• Scope: Elevation from user to admin/system level access
• Timeline: Minutes to hours after initial execution
• Adversary Mindset: “How do I get more powerful access?”

Key Activities:

• Payload execution
• Vulnerability exploitation
• Process injection
• Privilege escalation exploits
• Token manipulation

Detection Focus:

• Process execution monitoring
• Privilege escalation detection
• Memory analysis
• Behavioral anomaly detection

---

Kill Chain Phase 5: Installation

Phase Objective: Install malware and establish persistent access

Primary MITRE Tactics

Persistence (TA0003)

• Tactical Goal: Maintain access across restarts, credential changes, and other interruptions
• Scope: Techniques to keep access to systems
• Timeline: Minutes to hours after exploitation
• Adversary Mindset: “How do I ensure I don’t lose access?”

Defense Evasion (TA0005)

• Tactical Goal: Avoid being detected throughout the attack
• Scope: Techniques to hide presence and activities
• Timeline: Throughout the entire attack lifecycle
• Adversary Mindset: “How do I stay hidden from defenders?”

Key Activities:

• Service installation
• Registry modification
• Scheduled task creation
• Anti-forensics techniques
• Log deletion
• Process hiding

Detection Focus:

• Persistence mechanism monitoring
• Registry change detection
• Service creation alerts
• File system monitoring
• Anti-virus evasion detection

---

Kill Chain Phase 6: Command and Control (C2)

Phase Objective: Establish communication with compromised systems

Primary MITRE Tactic

Command and Control (TA0011)

• Tactical Goal: Communicate with compromised systems
• Scope: Techniques for communicating with systems under their control
• Timeline: Minutes after installation through end of operation
• Adversary Mindset: “How do I control my implants and receive data?”

Key Activities:

• C2 channel establishment
• Encrypted communications
• Protocol tunneling
• Domain fronting
• Data encoding

Detection Focus:

• Network traffic analysis
• DNS monitoring
• Encrypted traffic inspection
• Communication pattern analysis
• Beaconing detection

---

Kill Chain Phase 7: Actions on Objectives

Phase Objective: Achieve the ultimate goal of the attack

Primary MITRE Tactics

Credential Access (TA0006)

• Tactical Goal: Steal account names, passwords, and other credentials
• Scope: Techniques for stealing credentials from systems
• Timeline: Throughout operation, especially early in lateral movement
• Adversary Mindset: “How do I get more usernames and passwords?”

Discovery (TA0007)

• Tactical Goal: Figure out the environment and what they control
• Scope: Techniques for gaining knowledge about the system and network
• Timeline: Throughout operation, intensifying near objectives
• Adversary Mindset: “What’s in this network and where is my target data?”

Lateral Movement (TA0008)

• Tactical Goal: Move through the network to reach objectives
• Scope: Techniques to access and control remote systems
• Timeline: After initial access, continuing until objectives reached
• Adversary Mindset: “How do I get to where I need to go?”

Collection (TA0009)

• Tactical Goal: Gather information relevant to objectives
• Scope: Techniques for identifying and collecting target information
• Timeline: Near end of operation, when close to objectives
• Adversary Mindset: “How do I find and gather the data I need?”

Exfiltration (TA0010)

• Tactical Goal: Steal data from the network
• Scope: Techniques for moving data out of the compromised network
• Timeline: Final phase of data theft operations
• Adversary Mindset: “How do I get this data out without being caught?”

Impact (TA0040)

• Tactical Goal: Manipulate, interrupt, or destroy systems and data
• Scope: Techniques for final destructive or disruptive actions
• Timeline: Final phase of destructive operations
• Adversary Mindset: “How do I cause maximum damage or disruption?”

---

Tactical Flow Analysis

Sequential Tactical Progression

Reconnaissance → Resource Development → Initial Access → Execution
     ↓
Privilege Escalation → Persistence + Defense Evasion → Command and Control
     ↓
Credential Access → Discovery → Lateral Movement → Collection → Exfiltration/Impact

Parallel and Overlapping Tactics

Phase	Primary Tactics	Supporting Tactics
Reconnaissance	Reconnaissance	–
Weaponization	Resource Development	–
Delivery	Initial Access	Defense Evasion
Exploitation	Execution, Privilege Escalation	Defense Evasion
Installation	Persistence	Defense Evasion
Command & Control	Command and Control	Defense Evasion
Actions on Objectives	Discovery, Collection, Exfiltration, Impact	Credential Access, Lateral Movement, Defense Evasion

---

Tactical Relationships and Dependencies

Foundational Tactics (Required for Success)

• Initial Access: Entry point for all subsequent activities
• Execution: Necessary to run any malicious code
• Command and Control: Essential for coordinated operations

Enabling Tactics (Multiply Effectiveness)

• Privilege Escalation: Unlocks access to more resources
• Persistence: Ensures continued access for complex operations
• Defense Evasion: Protects all other tactical activities

Operational Tactics (Achieve Specific Goals)

• Credential Access: Enables lateral movement and privilege escalation
• Discovery: Provides intelligence for targeting decisions
• Lateral Movement: Extends reach within the network

Terminal Tactics (Final Objectives)

• Collection: Gathers target information
• Exfiltration: Achieves data theft objectives
• Impact: Achieves destructive/disruptive objectives

---

Detection Strategy by Tactical Phase

Early Phase Tactics (Reconnaissance, Resource Development)

Detection Approach: External monitoring and threat intelligence

• Monitor for reconnaissance activities
• Track infrastructure development
• Threat intelligence on adversary preparation

Key Indicators:

• Unusual external queries about the organization
• New domain registrations with suspicious patterns
• Malware development in underground forums

Entry Phase Tactics (Initial Access, Execution)

Detection Approach: Perimeter and endpoint monitoring

• Email security and web filtering
• Endpoint detection and response
• Network intrusion detection

Key Indicators:

• Malicious email attachments or links
• Exploitation attempts against public services
• Unusual process execution patterns

Establishment Phase Tactics (Privilege Escalation, Persistence, Defense Evasion)

Detection Approach: Host-based monitoring and behavioral analysis

• Privilege escalation monitoring
• Persistence mechanism detection
• Anti-evasion technologies

Key Indicators:

• Unauthorized privilege escalation
• New persistence mechanisms
• Attempts to disable security tools

Communication Phase Tactics (Command and Control)

Detection Approach: Network traffic analysis

• Communication pattern analysis
• Protocol anomaly detection
• DNS and domain monitoring

Key Indicators:

• Unusual outbound communications
• Encrypted traffic to suspicious destinations
• Beaconing patterns

Operational Phase Tactics (Credential Access, Discovery, Lateral Movement)

Detection Approach: Behavioral monitoring and access control

• Identity and access management
• Network segmentation monitoring
• User behavior analytics

Key Indicators:

• Credential theft attempts
• Unusual network reconnaissance
• Abnormal lateral movement patterns

Objective Phase Tactics (Collection, Exfiltration, Impact)

Detection Approach: Data protection and integrity monitoring

• Data loss prevention
• File integrity monitoring
• Backup and recovery monitoring

Key Indicators:

• Large data collection activities
• Unusual data transfer patterns
• File encryption or destruction activities

---

Operational Intelligence Applications

Threat Hunting Focus Areas

By Tactical Combination

• Persistence + Defense Evasion: Hunt for advanced persistent threats
• Credential Access + Lateral Movement: Focus on insider threat and advanced adversaries
• Collection + Exfiltration: Target data theft operations

By Tactical Sequence

• Track tactical progression to predict next adversary moves
• Identify gaps in tactical coverage for targeted hunting
• Develop hunting hypotheses based on tactical dependencies

Incident Response Prioritization

High-Priority Tactical Combinations

1. Initial Access + Execution + Persistence: Confirmed compromise with staying power
2. Privilege Escalation + Lateral Movement: Advanced threat with expansion capability
3. Collection + Exfiltration: Active data theft in progress

Tactical-Based Response Actions

• Early Tactics: Focus on containment and eradication
• Establishment Tactics: Comprehensive host remediation required
• Operational Tactics: Network segmentation and credential rotation
• Objective Tactics: Data protection and legal/regulatory notification

---

Strategic Recommendations

For Security Architecture

1. Layered Defenses: Align security controls to tactical phases
2. Kill Chain Breaking: Focus on disrupting tactical progression
3. Tactical Coverage: Ensure detection capabilities span all tactics

For Threat Intelligence

1. Tactical Indicators: Collect intelligence on adversary tactical preferences
2. Progression Mapping: Track how specific threat actors move through tactics
3. Predictive Analysis: Use early tactical indicators to predict later phases

For Security Operations

1. Tactical Playbooks: Develop response procedures based on tactical objectives
2. Escalation Criteria: Prioritize incidents based on tactical significance
3. Metrics and KPIs: Measure detection effectiveness across all tactics

This tactical mapping provides a strategic framework for understanding adversary intentions and aligning defensive capabilities with the evolving threat throughout the attack lifecycle.