Unified Kill Chain
Definition
An 18-phase model by Paul Pols (2017, updated 2021) that extends the Cyber Kill Chain by integrating MITRE ATT&CK and adding coverage of insider threats, supply-chain attacks, and multi-stage campaigns. Organised into three macro-stages: In, Through, and Out.
- Author
- Paul Pols, 2017, updated 2021
- Phases
- 18 phases
- Macro-stages
- In, Through, Out
- Builds on
- Cyber Kill Chain and MITRE ATT&CK
Common questions
What gap in the original Cyber Kill Chain does the Unified Kill Chain address?+
The Lockheed Martin Cyber Kill Chain models a single linear intrusion well but struggles with insider threats, lateral movement across many systems, and supply-chain compromise, which the Unified Kill Chain's added phases and macro-stages cover explicitly.
How is the Unified Kill Chain used differently from raw MITRE ATT&CK data?+
ATT&CK catalogues individual techniques without imposing a required order, while the Unified Kill Chain sequences those techniques into a narrative attack progression, making it more useful for briefing non-technical stakeholders on how an incident unfolded.
Related terms
- Cyber Kill Chain
- A seven-phase linear model of an intrusion developed by Lockheed Martin in 2011. The phases are: Reconnaissance, Weaponisation, Delivery, Exploitation, Installation, Command...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Lateral Movement
- Attacker activity after initial compromise in which the threat actor traverses from one internal system to another, typically to escalate privileges, access...
- MITRE ATT&CK
- A publicly available knowledge base of adversary tactics, techniques, and procedures derived from real-world intrusion observations. Maintained by the MITRE Corporation. Techniques...
- TTP (Tactics, Techniques, and Procedures)
- The three levels of specificity used to describe attacker behaviour. Tactics are the goal (e.g., persistence). Techniques are the method (e.g., scheduled...