Kill Chain Mapper

v1.0.0

Map MITRE ATT&CK techniques to your assets — recon, weaponization, delivery, exploitation, install, C2, action.

Threat name / actor

Initial access technique

Persistence technique

Lateral movement

Exfiltration / impact

MITRE ATT&CK Kill Chain Mapping

# Kill Chain Mapping: Ransomware group

| Phase | Technique | Mitigation |
|---|---|---|
| **Reconnaissance** | Open-source intelligence (OSINT) | Reduce public footprint, monitor data broker sites |
| **Initial Access** | Phishing (T1566) | Email filtering, MFA, security awareness training |
| **Execution** | PowerShell / scripting interpreter | Script block logging, AMSI, AppLocker |
| **Persistence** | Registry run keys (T1547) | Endpoint detection, integrity monitoring |
| **Lateral Movement** | Pass the Hash (T1550.002) | Network segmentation, credential hygiene, EDR |
| **Impact** | Data encrypted for impact (T1486) | Immutable backups, canary files, DLP |

# Detection Priorities
1. Monitor initial access vectors (email, web)
2. Alert on credential abuse patterns
3. Detect lateral movement (port scan, SMB anomalies)
4. Monitor for data staging/compression

# References
- MITRE ATT&CK: https://attack.mitre.org
- D3FEND: https://d3fend.mitre.org