How Attackers Think — The Kill Chain and MITRE ATT&CK

Every security control exists in reaction to an attack technique. Firewalls block unwanted connections because attackers probe open ports. MFA defeats credential theft because attackers steal passwords. EDR detects process injection because attackers inject code into legitimate processes. A defender who does not understand the attack does not understand why the control matters — and cannot evaluate whether it actually works.

This is not a philosophical point. It has operational consequences: a SOC analyst who does not understand the attacker's kill chain cannot prioritise which alerts matter. A security engineer who does not understand lateral movement techniques cannot design network segmentation that stops them. A CISO who does not understand attacker motivations cannot make the right investment decisions.

The Kill Chain model views an intrusion as a sequence of steps that an attacker must complete to achieve their objective. Each step is an opportunity for defenders to detect or disrupt. The key insight: attackers must complete every phase; defenders only need to break one.

The Kill Chain describes attack phases at a high level. MITRE ATT&CK catalogs the specific techniques attackers use at each phase — documented with real-world evidence from actual intrusions. As of 2026, the Enterprise matrix contains 14 tactics and over 200 techniques with 400+ sub-techniques.

ATT&CK is the reference framework used by SOC analysts (writing detection rules), red teams (planning realistic attack simulations), threat hunters (knowing what to look for), and security product vendors (mapping their detection capabilities). Understanding ATT&CK is expected knowledge for anyone working in security operations or offensive security.

The 14 MITRE ATT&CK Tactics

How ATT&CK Techniques Are Documented

Example: T1059.001 — Command and Scripting Interpreter: PowerShell

Tactic: Execution (TA0002)
Platforms: Windows
Permissions Required: User, Administrator

Description: Adversaries abuse PowerShell for execution. PowerShell is a powerful
interactive command-line interface included in the Windows operating system.

Procedure Examples (real attacker usage):
  APT32: Used PowerShell to download payloads and execute commands
  FIN7:  Used PowerShell for execution and persistence
  Cobalt Group: Used malicious PowerShell scripts for initial access

Detection:
  Monitor PowerShell process creation. Alert on:
    - PowerShell launching from unusual parent processes (Word, Excel, Outlook)
    - PowerShell with -EncodedCommand flag (obfuscation indicator)
    - PowerShell making network connections
    - PowerShell downloading content from the internet

Mitigations:
  M1042: Disable or Remove Feature — Disable PowerShell v2 (lacks logging)
  M1049: Antivirus/Antimalware
  M1038: Execution Prevention — AppLocker or WDAC policy

Living off the land (LotL) is an attack technique where the attacker uses legitimate system tools already present on the victim machine rather than deploying custom malware. This technique is extremely effective because antivirus and EDR products detect malicious files — but cannot block trusted system binaries. A defender who sees PowerShell, WMI, or certutil running must distinguish legitimate usage from malicious usage based on behaviour context — a much harder problem than blocking a known-malicious file hash.

Windows LOLBins (Living Off the Land Binaries) abused by attackers:

powershell.exe  → Execute scripts, download payloads, bypass execution policy
certutil.exe    → Download files from internet, decode base64 payloads
mshta.exe       → Execute HTML Application files (HTA) containing VBScript
regsvr32.exe    → Register COM objects — can load DLLs from remote URLs
wmic.exe        → Execute commands on local/remote systems, enumerate environment
bitsadmin.exe   → Download files silently in the background
rundll32.exe    → Execute DLL functions — evades simple process-based detection

Example attack chain using only LOLBins (no malware files):
1. Phishing document opened → macro runs:
   powershell.exe -EncodedCommand [base64 download cradle]
2. PowerShell downloads next stage:
   certutil.exe -decode encoded.txt payload.exe
3. Payload runs via: rundll32.exe
4. Persistence via WMI subscription (survives reboot, no file in startup folder)

All steps used only signed Windows binaries — no malware detected by AV

Detecting LOLBin Abuse

Detection shifts to behavioural analysis: process lineage (PowerShell spawned by Word.exe is suspicious), command line arguments (certutil with a URL is unusual), network connections (certutil.exe making outbound HTTP), and timing anomalies (WMI at 2am from a workstation). Sigma rules provide a community-maintained library of LOLBin detection rules convertible to Splunk, Elastic, and Sentinel query languages.

Threat-informed defence uses knowledge of specific attacker TTPs to prioritise defensive investment. Rather than defending against every possible attack equally, identify which threat actors are most relevant and focus detection on those actors' specific techniques.