Security
kill chain
the ordered stages of an intrusion (MITRE ATT&CK / Lockheed)
Source board
This definition comes from the board below. Open it to see the term in context.
Anatomy of a BreachSecurityMore terms from this board
- blameless post-mortemfix the bug class, not the person
- blast radiuswhat one compromise can reach (limited by least privilege)
- C2command & control channel
- dwell timehow long undetected (often months)
- exfiltrationstealing data out
- incident responsecontain→eradicate→recover→learn
- initial accessthe foothold (phishing / exploit / stolen creds)
- lateral movementspreading to other systems
- MTTD/MTTRmean time to detect / respond
- persistencesurviving reboots/rotations
- privilege escalationgaining higher rights
- reconstudying the target
- segmentationisolate networks so lateral movement fails
- SIEM/EDRdetection tooling
- the whole trackthe chain's defense