Hack the Route Start free Open app Detection and response
Kill chain and MITRE ATT&CK
Models that break an intrusion into ordered stages, giving defenders shared language for what happened.
The kill chain describes an intrusion as stages — reconnaissance, initial access, execution, persistence, command-and-control, actions on objectives — and MITRE ATT&CK catalogues the concrete techniques attackers use at each. Mapping an incident onto them turns scattered findings into a story: a port scan (recon), a beacon (C2), a cron entry (persistence). It also shows where a defence breaks the chain, and gives reports a common vocabulary.