Using The Unified Kill Chain Model to Analyse Individual Cyber Attacks
Last updated
Last updated
is a combination of the and tactics. It is intended to be an updated version of the Cyber Kill Chain to better fit modern attacks.
The Unified Kill Chain (UKC) is an evolution of traditional attack kill chain models. It combines concepts from Lockheed Martin's Cyber Kill Chain and MITRE’s ATT&CK framework to create a comprehensive, detailed representation of the entire attack lifecycle. The UKC bridges gaps in traditional models by including both the attacker’s tactics and techniques and a defender’s perspective for detecting, mitigating, and responding to threats across all stages of an attack.
UKC defines the attack lifecycle through three overarching phases, further broken into 18 distinct steps. These phases encapsulate the attacker’s journey from initial access to achieving their objectives, providing a comprehensive understanding of modern cyberattacks.
The UKC is organised into three overarching categories that encompass the complete lifecycle of a cyberattack:
Network Propagation: Once inside, attackers aim to expand their reach within the network. This includes lateral movement, privilege escalation, credential harvesting, and reconnaissance to locate high-value targets.
Actions on Objectives: In this phase, attackers execute their end goal, such as exfiltrating sensitive data, deploying ransomware, or disrupting services.
By combining and mapping steps from the Cyber Kill Chain (focused on the progression of an attack) and MITRE’s ATT&CK framework (focused on specific techniques and tactics used by attackers), the UKC offers a granular, actionable roadmap for understanding attacks and implementing defences.
The Unified Kill Chain 18 phases or tactics are the steps a cyberattack may progress through. Any particular attack can skip phases, repeat phases, or go out of order.
Reconnaissance: identify and select targets
Weaponization: set up infrastructure for attack
Delivery: Send weaponised object (e.g., malware) to target
Social Engineering: manipulate people to perform unsafe actions
Exploitation: take advantage of a vulnerability on target’s systems (possibly to execute code)
Persistence: maintain access to systems
Defense Evasion: avoiding detection and defences
Command and Control: communicate with compromised systems to control them
Pivoting: use a controlled system to gain access to others
Discovery: gain knowledge about system and network
Privilege Escalation: gain higher-level permissions
Execution: run attacker-controlled code
Credential Access: steal usernames and passwords
Lateral Movement: access and control other systems
Collection: gather data of interest
Exfiltration: steal data from the network
Impact: manipulate, interrupt, or destroy systems or data
Objectives: use social and technical means to achieve strategic goal
This phase covers the attacker’s efforts to infiltrate the target network or system and establish an initial presence. It mirrors the early stages of traditional attack models like reconnaissance and exploitation. The attacker seeks to avoid detection while planting the seeds for further exploitation.
Reconnaissance: Gathering information about the target, such as network structure, technologies in use, or employee data, to identify vulnerabilities.
Weaponisation: Developing or acquiring tools, such as malware or exploit kits, to target identified vulnerabilities.
Delivery: Transmitting the weaponised payload to the target, often via phishing emails, malicious links, or USB drives.
Exploitation: Exploiting a vulnerability in the target system to gain unauthorised access.
Installation: Installing malware or a backdoor to maintain access to the compromised system.
After gaining a foothold, attackers focus on expanding their control within the target environment. This phase includes lateral movement, privilege escalation, and reconnaissance within the network to achieve broader access and visibility.
Command and Control (C2): Establishing a communication channel between the compromised system and the attacker’s infrastructure for remote control.
Internal Reconnaissance: Mapping the network, discovering connected systems, and identifying valuable assets or credentials for further exploitation.
Credential Dumping: Extracting credentials from the compromised system for use in lateral movement or privilege escalation.
Privilege Escalation: Elevating access privileges to administrative or system levels.
Lateral Movement: Moving across the network to access additional systems or resources using stolen credentials or exploits.
Persistence: Establishing mechanisms to maintain access over time, such as creating new accounts, modifying registry keys, or deploying backdoors.
In this final phase, attackers achieve their ultimate objectives, such as stealing data, deploying ransomware, or causing system disruption. This phase represents the culmination of their activities within the target environment.
Data Collection: Gathering sensitive information, intellectual property, or financial records from compromised systems.
Data Exfiltration: Transferring stolen data to external locations controlled by the attacker.
Impact: Causing harm to the organisation, which may include encrypting files (ransomware), destroying systems, or disrupting operations.
Defence Evasion: Taking steps to avoid detection or remediation by clearing logs, disabling security tools, or masking activity.
Anti-Forensics: Modifying or destroying forensic evidence to hinder investigation and analysis.
Execution: Running final malicious commands, scripts, or payloads to achieve their goals.
Action Completion: Wrapping up the attack by either covering tracks or preparing the system for future exploitation.
The UKC provides defenders with a more flexible and realistic approach to cyber threats compared to earlier models. It emphasises the need for visibility across every phase of the attack lifecycle and supports mapping detection strategies and response actions to attacker behaviours. Additionally, it helps SOC teams and cybersecurity professionals prioritise their efforts by focusing on breaking the chain of events that attackers rely on to achieve their objectives.
By leveraging the UKC, organisations can better align their detection, prevention, and response efforts with real-world attack patterns, improving their resilience against sophisticated threats. It serves as a foundational tool for designing robust defence-in-depth strategies that incorporate endpoint protection, network monitoring, and advanced threat-hunting capabilities.
The Initial Foothold phase focuses on getting access to the target. The Network Propagation phase emphasises gaining more profound control and access across the environment. Finally, the Actions on Objectives phase centres on achieving the attacker's ultimate goals, ranging from data theft to operational disruption. By breaking down these phases into 18 steps, the UKC provides a granular, actionable roadmap for defenders to identify, mitigate, and disrupt attacks at every stage. It enables a proactive defence by offering insights into attackers' tactics, techniques, and procedures (TTPs).
: These steps focus on how attackers gain access to a system or network. Techniques include social engineering, phishing, exploiting vulnerabilities, or supply chain attacks.