adam's notes

Unified Kill Chain

The Unified kill chain is a threat model that details the tactics that form the building blocks of modern cyber attacks by Advanced Persistent Threats (APTs) as well as ransomware groups.

  • Created by Paul Pol in 2017
  • Link
  • provides insights into the ordered arrangement of phases in attacks
  • 18 phases to an attack

Goal: Initial Foothold

  • main focus of this series of phases is for an attacker to gain access to a system or networked environment
  • attacker will employ numerous tactics to investigate the system for potential vulnerabilities that can be exploited to gain a foothold in the system

Reconnaissance (MITRE Tactic TA0043)

  • This phase of the UKC describes techniques that an adversary employs to gather information relating to their target
  • can be achieved through means of passive and active reconnaissance

Weaponization (MITRE Tactic TA0001)

  • This phase of the UKC describes the adversary setting up the necessary infrastructure to perform the attack
  • e.g., this could be setting up a command and control server, or a system capable of catching reverse shells and delivering payloads to the system

Social Engineering (MITRE Tactic TA0001)

  • describes techniques that an adversary can employ to manipulate employees to perform actions that will aid in the adversaries attack

Exploitation (MITRE Tactic TA0002)

  • describes how an attacker takes advantage of weaknesses or vulnerabilities present in a system
  • defines “Exploitation” as abuse of vulnerabilities to perform code execution

Persistence (MITRE Tactic TA0003)

  •  this phase of the UKC describes the techniques an adversary uses to maintain access to a system they have gained an initial foothold on

Defense Evasion (MITRE Tactic TA0005)

  • used to understand the techniques an adversary uses to evade defensive measures put in place in the system or network
  • valuable when analyzing an attack as it helps form a response and gives the defensive team information on how they can improve their defense systems

Command & Control (MITRE Tactic TA0011)

  • combines the efforts an adversary made during the “Weaponization” stage of the UKC to establish communications between the adversary and target system

Pivoting (MITRE Tactic TA0008)

  • Pivoting is the technique an adversary uses to reach other systems within a network that are not otherwise accessible
  • e.g., adversary can gain access to a web server that is publically accessible to attack other systems that are within the same network

Goal: Network Propagation

  • follows a successful foothold being established on the target network

Pivoting (MITRE Tactic TA0008)

  • use access as their staging site and a tunnel between their command operations and the victim’s network

Discovery (MITRE Tactic TA0007)

  • uncover information about the system and the network it is connected to
  •  knowledge base would be built from the active user accounts, the permissions granted, applications and software in use, web browser activity, files, directories and network shares, and system configurations

Privilege Escalation (MITRE Tactic TA0004)

  • try to gain more prominent permissions within the pivot system

Execution (MITRE Tactic TA0002)

  • deploy their malicious code using the pivot system as their host

Credential Access (MITRE Tactic TA0006)

  • attempt to steal account names and passwords through various methods, including keylogging and credential dumping

Lateral Movement (MITRE Tactic TA0008)

  • seek to move through the network and jump onto other targeted systems to achieve their primary objective

Goal: Action on Objectives

  • The “Out” goal wraps up the journey of an adversary’s attack on an environment, where they have critical asset access and can fulfill their attack goals

Collection (MITRE Tactic TA0009)

  • seeking to gather all the valuable data of interest
  • compromises the confidentiality of the data and would lead to the next attack stage – Exfiltration

Exfiltration (MITRE Tactic TA0010)

  •  seek to steal data, which would be packaged using encryption measures and compression to avoid any detection

Impact (MITRE Tactic TA0040)

  • seeks to compromise the integrity and availability of the data assets
    • manipulate, interrupt or destroy these assets
  • goal would be to disrupt business and operational processes
  • may involve
    • removing account access
    • disk wipes
    • and data encryption such as ransomware, defacement and denial of service (DoS) attacks

Objectives

  • seek to achieve their strategic goal for the attack

Reference

Unified kill chain. (2022, September 27). tryhackme.com. Retrieved June 28, 2026, from https://tryhackme.com/room/unifiedkillchain

Graph View

Backlinks