When a security incident occurs, one of the first questions organizations ask is “Which vulnerability caused it?” Usually, there isn’t a single answer. Enterprise attacks are rarely the result of a single weakness. Instead, attackers combine multiple exposures to move through an environment until they reach a valuable objective.
This progression is known as an attack path. Rather than evaluating vulnerabilities independently, attack path analysis examines how seemingly independent exposures, weaknesses, compromised identities, privileges, assets, and trust relationships can interact and enable an attacker to move through an environment toward a specific objective. This provides greater context for understanding how individual weaknesses can contribute to a complete compromise and helps security teams prioritize risk based on the paths that matter most.
The Cyber Kill Chain and MITRE ATT&CK Framework provide complementary structures for understanding attack paths. While the Cyber Kill Chain describes the stages of an intrusion, MITRE ATT&CK documents the tactics, techniques, and procedures adversaries use throughout those stages. Together, they allow offensive security teams to analyze attacker behavior, conduct cyberattack simulation, and identify the attack paths that pose the greatest risk.
Understanding Attack Paths
Since every enterprise has a different architecture, identity model, and security posture, attack paths are unique to each organization. The same vulnerability may represent a dead end in one environment but become the first step toward domain compromise or cloud administration in another.
Consider an attacker who exploits a vulnerable VPN gateway, steals administrator credentials, moves laterally through Active Directory (AD), and encrypts critical servers. That sequence represents an attack path. The following sections use this example to examine how an attack can be broken down into its stages and individual adversary behaviors using the Cyber Kill Chain and MITRE ATT&CK.
The Cyber Kill Chain
Developed by Lockheed Martin in 2011, the cyber kill chain is an intrusion model designed to describe how an attacker progresses from identifying a target to achieving an operational objective. Originally developed to help organizations defend against Advanced Persistent Threats (APTs), the framework shifted security thinking away from responding to isolated security events and toward understanding an attack as a complete lifecycle.
The core idea behind the cyber kill chain is that an intrusion is not a single event but a sequence of dependent stages. As an intrusion progresses, it leaves behind evidence in the form of indicators, allowing defenders to reconstruct attacker activity, identify detection opportunities, and improve cyber defense strategies.
The cyber kill chain consists of seven stages:
- Reconnaissance: The attacker gathers information about the target organization. This may include identifying public-facing applications, employee email addresses, VPN portals, cloud services, technology stacks, and information available through OSINT.
In our example, the attacker identifies an internet-facing VPN gateway used by the organization and determines the technology and version running on the exposed service.
- Weaponization: Using the information collected during reconnaissance, the attacker prepares the resources required for the intrusion. This could involve creating a phishing document, modifying malware to evade detection, or developing an exploit for an unpatched vulnerability.
Here, the attacker prepares an exploit targeting the identified VPN vulnerability.
- Delivery: The attacker delivers the payload to the target. Delivery methods include phishing emails, compromised websites, exposed applications, software updates, removable media, or supply chain components.
In a direct exploitation scenario, the distinction between Delivery and Exploitation can be less pronounced than in a phishing or malware-delivery scenario. The attacker may interact directly with the exposed service and exploit the vulnerability without delivering a separate weaponized file to a user.
- Exploitation: The delivered payload succeeds. A user opens the malicious attachment, a vulnerability is exploited, or stolen credentials are used to authenticate successfully.
The attacker exploits the vulnerable VPN gateway and gains access to the enterprise environment.
- Installation: After gaining access, the attacker may establish persistence or deploy mechanisms that allow continued access to the compromised environment. This may involve installing malware, deploying a web shell, creating scheduled tasks, registering malicious services, or adding unauthorized accounts that provide continued access.
The attacker establishes a mechanism that allows continued access to the compromised environment.
- Command and Control (C2): The compromised system establishes communication with attacker-controlled infrastructure, allowing commands to be issued remotely.
Through this channel, the attacker can execute additional tooling, harvest credentials, discover internal systems, and continue the intrusion.
- Actions on Objectives: Having achieved sufficient access, the attacker carries out the intended objective. Depending on the campaign, this may involve stealing sensitive data, encrypting systems for ransomware, disrupting operations, compromising domain controllers, abusing cloud administration privileges, or maintaining long-term persistence for espionage.
In our example, the attacker uses compromised administrator credentials to move through the AD environment and ultimately encrypts critical servers.
The framework remains valuable because it provides a high-level model for understanding an intrusion. However, modern attacks rarely follow a strict linear sequence. Attackers may revisit reconnaissance after gaining access, pivot between multiple systems, and pursue several objectives simultaneously. The cyber kill chain explains how an attack progresses, but it does not describe the specific tactics and techniques used to execute each action. MITRE ATT&CK provides that level of detail.
MITRE ATT&CK: Mapping Adversary Behavior
MITRE ATT&CK is a knowledge base and taxonomy of adversary behavior developed from real-world observations across enterprise, mobile, and industrial control systems (ICSs).
ATT&CK organizes adversary behavior through tactics, techniques, and sub-techniques, with procedures providing examples of how specific adversaries, software, or campaigns have implemented them.
A tactic represents the adversary’s objective at a particular point in an operation. Enterprise tactics include Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.
In April 2026, MITRE split the old Defense Evasion tactic into two: Stealth, for hiding from security tools, and Defense Impairment, for disabling them. Stealth and Defense Impairment are new names.
A technique describes how an adversary achieves or attempts to achieve a tactical objective. For example, under the Initial Access tactic, an attacker may use Phishing (T1566), Valid Accounts (T1078), or Exploit Public-Facing Application (T1190). A technique can be relevant to different tactics depending on how the adversary uses it. Valid Accounts, for example, may support Initial Access, Persistence, Privilege Escalation, or other tactical objectives. ATT&CK therefore represents adversary behavior as a flexible set of actions rather than a fixed sequence.
A sub-technique provides a more specific description of how a technique is performed. For example, OS Credential Dumping (T1003) is a parent technique that includes sub-techniques such as LSASS Memory (T1003.001) and Security Account Manager (T1003.002), each describing a more specific credential-dumping method. This distinction allows an assessment to record not only that credentials were obtained, but also the specific mechanism used to obtain them.
A procedure describes how a specific adversary, malware family, or software has been observed implementing a technique or sub-technique. For example, one adversary may use PowerShell to download additional tooling, while another may use PowerShell to execute commands or disable security controls. The underlying technique may be the same, but the procedure captures the specific implementation observed in that operation.
The attacker could gain Initial Access by exploiting a vulnerability using stolen credentials or another method. They could obtain credentials through credential dumping, unsecured files, or account compromise. They could move laterally using Remote Desktop Protocol (RDP), Server Message Block (SMB), or other remote services.
Mapping an Attack Path to ATT&CK
Consider the same VPN attack path. The attacker has identified an internet-facing VPN gateway and determined that it is vulnerable. The exploitation of that exposed service can be mapped to Exploit Public-Facing Application (T1190) under the Initial Access tactic.
In a possible continuation of the attack path, the attacker targets privileged credentials. If those credentials are recovered from operating system memory, the activity could map to OS Credential Dumping (T1003). If previously obtained administrator credentials are used to authenticate to other systems, that behavior can be mapped to Valid Accounts (T1078).
With valid administrator credentials, the attacker begins discovering the internal environment. Techniques such as Account Discovery (T1087), System Network Configuration Discovery (T1016), Remote System Discovery (T1018), and Permission Groups Discovery (T1069) can describe the actions used to identify users, systems, network relationships, and privileged groups.
The attacker then moves laterally through the AD environment. Depending on the path taken, Remote Services (T1021) and its sub-techniques can describe lateral movement using services such as RDP, SMB/Windows Admin Shares, Secure Shell, or Windows Remote Management. The same Valid Accounts (T1078) technique may also continue to apply because the attacker is using compromised credentials to access additional systems.
Eventually, the attacker reaches critical servers with sufficient privileges to execute the final objective. In a ransomware scenario, that objective can be mapped to Data Encrypted for Impact (T1486).
The important point is that the attack path is not the collection of ATT&CK identifiers but the sequence of relationships that allows one compromise to lead to another.
Additionally, ATT&CK shows why two attack paths that appear similar at a high level can require very different security controls. An attacker using stolen credentials follows a different behavioral path from one relying on malware, even if both ultimately reach the same domain controller or critical server.
How Offensive Security Teams Use ATT&CK
During adversary emulation, ATT&CK helps operators select behaviors associated with relevant threat groups rather than techniques chosen simply because they are convenient to execute. MITRE’s adversary emulation plans map documented threat-actor behavior to specific techniques and procedures, allowing teams to reproduce representative tradecraft in a controlled assessment.
In a red team assessment, operators can map each completed action to ATT&CK as the intrusion develops. This provides a structured record of how access was obtained, which behaviors succeeded, what telemetry was generated, which controls intervened, and where the operation progressed without detection.
Purple teams use the same mapping to coordinate offensive execution with defensive validation. The red team performs an agreed technique or procedure, while the blue team verifies whether the behavior generates the required telemetry, is detected by the relevant analytics, and triggers an appropriate response.
ATT&CK can also support assessment planning and coverage analysis. Using ATT&CK Navigator, teams can visualize techniques relevant to a threat profile, plan engagements, document demonstrated techniques, and assess preventive and detective coverage.
Cyber threat intelligence can further inform offensive security planning by identifying adversaries, techniques, and behaviors relevant to a specific organization or sector. This allows teams to prioritize realistic threat scenarios rather than attempting to reproduce every technique in the ATT&CK knowledge base.
For defensive teams, ATT&CK supports threat detection, threat hunting, and incident response by helping Security Operations Center (SOC) teams organize detection coverage and identify gaps in relevant attacker behaviors. For a deeper look at the defensive application of ATT&CK, see MITRE ATT&CK Framework: How Modern SOCs Detect Attacker Behavior.
How Anzen Helps Organizations Validate Attack Paths
For security leaders, attack path analysis provides a way to evaluate whether an attacker could progress from an initial exposure to a business-critical objective. The goal is not to map every technique in ATT&CK or every stage of the Kill Chain, but to understand which attack paths are viable in their environment, which critical business services or assets they could reach, and where security controls can prevent, detect, or contain them before they result in business impact. At Anzen, our offensive security and red team engagements use these frameworks to model attacker behavior, validate attack paths, and assess how effectively security controls perform throughout an intrusion. This helps security teams identify where controls break down and prioritize remediation based on the paths that present the greatest risk.
FAQ’s
What is attack chaining in cybersecurity?
Attack chaining is the process of combining multiple weaknesses, compromised identities, privileges, misconfigurations, or security gaps to progress through an environment toward a specific objective. Rather than exploiting a single vulnerability, an attacker may chain weaknesses, compromised credentials, and trust relationships to reach critical systems.
How does attack chaining work?
Attack chaining works by linking individual attacker actions so that the outcome of one step enables the next. For example, an attacker may exploit a public-facing application, obtain credentials, discover internal systems, move laterally using valid accounts, and ultimately access a critical server.
What is the difference between attack chaining and exploit chaining?
Attack chaining refers broadly to linking multiple attacker actions or security weaknesses to achieve an objective, while exploit chaining specifically refers to combining multiple exploits or vulnerabilities. Exploit chaining can therefore be one component of a broader attack chain that may also involve credential compromise, privilege escalation, lateral movement, and abuse of legitimate access.
What is the Cyber Kill Chain framework?
The cyber kill chain is an intrusion model that describes seven stages of a cyberattack: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. It provides a high-level view of how an intrusion can progress and helps security teams identify opportunities to disrupt an attack.
What is the MITRE ATT&CK Framework?
MITRE ATT&CK is a knowledge base of adversary tactics and techniques, built from observed real-world intrusions, that organizes attacker behavior into 15 enterprise tactics and a detailed catalog of specific techniques and sub-techniques within each.
What is the difference between the Cyber Kill Chain and MITRE ATT&CK?
The Cyber Kill Chain provides a high-level model of how an intrusion progresses, while MITRE ATT&CK provides greater detail on the tactics, techniques, and procedures adversaries use during their operations. The two can be used together to understand both the broader progression of an attack and the specific behaviors used to execute it.
What is initial access in a cyberattack?
Initial Access is the stage at which an attacker first gains access to a target environment. Common methods include exploiting public-facing applications, phishing, using valid accounts, and exploiting external remote services.
What is lateral movement in cybersecurity?
Lateral movement is the process of moving from one compromised system or account to additional systems within an environment. Attackers may use compromised credentials and remote services such as remote desktop protocol, server message block, or other mechanisms to access additional hosts and move closer to their objective.
How is MITRE ATT&CK used in red teaming?
Red teams use MITRE ATT&CK to structure adversary emulation around documented attacker behaviors and threat actor techniques. Mapping activities to ATT&CK helps teams document what was executed, assess whether security controls detected or prevented those behaviors, and identify gaps in defensive coverage.
How does MITRE ATT&CK mapping improve threat detection?
MITRE ATT&CK mapping helps security teams organize detection coverage around known adversary behaviors rather than isolated indicators. By mapping telemetry and detection rules to relevant ATT&CK techniques, SOC teams can identify coverage gaps, prioritize detection engineering, and support threat hunting and incident response.