<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: building-kill-chain-analysis
description: >-
  Map threats and attacks to the Cyber Kill Chain phases (Reconnaissance through Actions on Objectives) to identify defensive opportunities at each stage and break attack progression.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - kill-chain
  - lockheed-martin
  - attack-phases
  - defense-in-depth
  - detection-opportunities
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1595", "T1190", "T1059", "T1053", "T1021", "T1041"]
---

# Building Kill Chain Analysis

## Overview

Kill Chain analysis maps attacks to the Lockheed Martin Cyber Kill Chain phases, identifying
defensive opportunities at each stage to break attack progression. This technique covers
phase mapping, detection point identification, and defensive gap analysis.

Mode: `[MODE: BLUE]` — Defensive kill chain analysis and detection engineering.

## Prerequisites

- Understanding of the Lockheed Martin Cyber Kill Chain model
- Threat intelligence on relevant attack campaigns
- Detection and monitoring capabilities inventory
- Python 3.10+

## Key Concepts

### Cyber Kill Chain Phases

| Phase | Description | Defensive Opportunity |
|-------|-------------|----------------------|
| 1. Reconnaissance | Target research, scanning | Threat intel, honeypots, OSINT monitoring |
| 2. Weaponization | Exploit/payload creation | Threat intel sharing, sandbox analysis |
| 3. Delivery | Transmit payload to target | Email filtering, web proxy, WAF |
| 4. Exploitation | Trigger vulnerability | Patching, DEP/ASLR, application hardening |
| 5. Installation | Establish persistence | EDR, application whitelisting, integrity monitoring |
| 6. Command & Control | Remote control channel | DNS monitoring, proxy filtering, network segmentation |
| 7. Actions on Objectives | Achieve goal (exfil, destroy) | DLP, backup/recovery, network monitoring |

### Left of Boom vs Right of Boom

- **Left of Boom** (Phases 1–3): Prevent the attack from reaching the target
- **Right of Boom** (Phases 4–7): Detect and contain after initial compromise
- **Goal**: Push defenses as far left as possible while maintaining right-side resilience

### Detection Opportunity Matrix

For each phase, identify:
- **Data sources**: What telemetry is available?
- **Detection rules**: What patterns can we match?
- **Response actions**: What automated/manual actions are triggered?
- **Gaps**: Where do we lack visibility?

## Workflow

### Step 1: Map Attack to Kill Chain

```bash
node scripts/agent.js --action map --input attack-scenario.json --output kill-chain.json
```

### Step 2: Identify Detection Points

```bash
node scripts/agent.js --action detect --input kill-chain.json --output detections.json
```

### Step 3: Analyze Defensive Coverage

```bash
node scripts/agent.js --action coverage --input detections.json --output coverage.json
```

### Step 4: Generate Defense Report

```bash
node scripts/agent.js --action report --input coverage.json --output kill-chain-report.json
```

## Verification

- [ ] Attack scenario mapped to all applicable Kill Chain phases
- [ ] Detection opportunities identified at each phase
- [ ] Left-of-boom defenses prioritized for maximum prevention
- [ ] Right-of-boom detection and response capabilities validated
- [ ] Coverage gaps identified with remediation recommendations
- [ ] Kill Chain analysis reviewed with SOC and IR teams

## References

- [Lockheed Martin Cyber Kill Chain](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [Intelligence-Driven Computer Network Defense](https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf)
