The seven phases
Click any phase to see what happens, plus an example drawn from the ransomware attack on the previous page. The connection is intentional — every kill-chain phase maps to specific MITRE ATT&CK tactics, and every defensive control disrupts specific phases.
What changed between Lockheed (2011) and MITRE ATT&CK (2013+)
The Kill Chain has seven phases. MITRE ATT&CK — the modern alternative — has fourteen "tactics" (and ~200 sub-techniques under each). Why the inflation?
- Kill Chain is linear; ATT&CK is a graph. Real attacks loop: post-installation, attackers do more reconnaissance (this time from inside), more exploitation (privilege escalation), more delivery (lateral movement). ATT&CK calls these out as separate tactics rather than folding them into "Actions on Objectives."
- ATT&CK separates "tactic" (the why) from "technique" (the how). Lateral Movement is a tactic; "Pass the Hash" is a technique that achieves it. Defenses are easier to map to techniques than to phases.
- ATT&CK is observational. Each technique is documented with which threat groups used it, on which platforms, with which detection signals. The Kill Chain is a model; ATT&CK is a database.
In practice, defensive teams use both. The Kill Chain is a way to talk to executives about what attackers do. ATT&CK is a way to tell engineers which specific behaviors to detect.
The MITRE ATT&CK tactics, briefly
| Tactic | What the attacker wants |
|---|---|
| Reconnaissance | Gather information about the target before access. |
| Resource Development | Build the infrastructure (servers, accounts, malware) for the campaign. |
| Initial Access | Get the first foothold on a target system. |
| Execution | Run attacker-controlled code on the foothold. |
| Persistence | Stay on the system across reboots and credential changes. |
| Privilege Escalation | Move from low-privilege to high-privilege access. |
| Defense Evasion | Avoid detection by AV, EDR, logging, humans. |
| Credential Access | Steal passwords, tokens, keys. |
| Discovery | Map the environment from inside: hosts, services, accounts, network shares. |
| Lateral Movement | Move from compromised host to other hosts. |
| Collection | Gather data of interest (files, mailboxes, databases). |
| Command & Control | Maintain remote control of the compromised systems. |
| Exfiltration | Move stolen data out of the target environment. |
| Impact | Encrypt, destroy, manipulate — the final objective. |
Why this matters defensively
The whole point of the chain is that defenders don't have to win at every phase — they just have to win at one. The attacker has to succeed at all seven (or all fourteen) in sequence. Force them to make seven independent bets and the math tilts hard in the defender's favor.
That's the lens the next page uses: every defensive control we list (EDR, allowlisting, segmentation, backups, MFA) is annotated with which kill-chain phases it disrupts. The goal is not to deploy the maximum number of controls; it's to ensure no single phase has a single defender.