Breaking One Kill-Chain Stage Does Not Stop the Intrusion

“We have a control at every stage of the kill chain, so any intrusion gets broken somewhere.”

Let me stop you there.

That sentence assumes the intrusion is polite enough to visit every stage.

Breaking one stage does not stop an intrusion that never needed it.

Lockheed Martin’s Cyber Kill Chain names seven stages in strict sequence.

Reconnaissance.

Weaponization.

Delivery.

Exploitation.

Installation.

Command and Control.

Actions on Objectives.

Its operating claim is that an intrusion must complete every stage in order to succeed.

So a defender who breaks the chain at any single stage defeats the whole attack.

That is a claim about how the adversary behaves.

It is not a claim about your system.

It was built for perimeter-era defence, where the job was to catch a payload in transit toward one target.

Map one control to each of those seven boxes and you have not built coverage.

You have bought the model’s assumption that every box will be visited, and you have written it into your control plan.

Nobody would say, “We lock the front door, so nobody can be in the building.”

Somebody with a key is already in the building.

Say the same thing with seven boxes and a vendor slide, and apparently it is architecture.

1. “But the Kill Chain Is What Our Training and Incident Reports Use.”

It is.

That tells you why it persists, not that it is true of every intrusion.

The kill chain carries no legal or regulatory force.

It is a vendor-published framework that stays in training material and incident narratives because it is simple to teach.

Simple to teach is a real virtue.

It is not evidence of sequence.

The model has no stage of its own for persistence, lateral movement or exfiltration.

Persistence is folded into Installation.

Lateral movement and exfiltration are folded into Actions on Objectives.

That is precise enough to narrate one malware delivery.

It is too coarse to describe how an adversary moves through a segmented, cloud-hybrid network once inside.

So keep the story for the training deck.

Just notice that three whole families of internal behaviour share two boxes, and one of them is the last box, where your per-stage plan probably holds one control.

2. “But the Mail Gateway Blocks Delivery, So the Chain Breaks Early.”

It breaks the chain for intrusions that arrive by mail.

That is a subset.

ATT&CK’s Initial Access tactic, TA0001, carries 11 techniques and 11 sub-techniques.

Twenty-two entries, from phishing to supply-chain compromise.

Your mail gateway addresses one family of them.

The 2026 Verizon DBIR put vulnerability exploitation at 31% of breaches as an initial-access vector.

No message.

No attachment.

Nothing for the gateway to inspect.

Phishing, T1566, is cheap for the attacker and mature for the defender, precisely because its volume forced the tooling to exist.

Email-metadata correlation.

Link-detonation sandboxes.

Alerts on anomalous child processes.

Good.

A mature control for one entry route is still a control for one entry route.

Then there is the adversary who needs no entry route at all.

An adversary already holding valid credentials can begin at Lateral Movement, TA0008.

No delivery.

No exploitation.

No payload in transit for anyone to catch.

A broken link does nothing to an intrusion that never used that link.

3. “But the EDR Covers Installation.”

Which installation?

“Installation” is one kill-chain box.

Behind it sit techniques that defeat review by entirely different mechanisms.

A scheduled task, T1053.005, can be made to disappear from the Task Scheduler interface and enumeration APIs by deleting its Security Descriptor registry value.

That is active concealment.

A registry run key, T1547.001, has no equivalent trick.

Its Run and RunOnce entries stay visible to any registry viewer indefinitely.

It hides by volume instead, among dozens of legitimate startup entries that few organizations audit routinely.

Same stage.

Roughly the same attacker cost.

Two different reasons your review misses them.

Then look at what the EDR is actually good at.

Custom malware produces signal almost by definition: an unrecognized binary, an unfamiliar process name, a hash off the baseline, a connection to infrastructure with no reputation.

File-reputation tooling exists to catch exactly that.

Living-off-the-land execution produces none of it.

System Binary Proxy Execution, T1218, runs through rundll32.exe, mshta.exe or regsvr32.exe.

Present on nearly every Windows install.

Signed by Microsoft.

Invoked constantly by legitimate software.

Signature tooling has nothing to flag.

The only signal is behavioural, an unusual parameter passed to a binary that normally receives predictable ones.

Seeing that needs command-line and script-block logging, enabled and retained, which is often disabled by default for performance or storage reasons.

It also needs a baseline of what normal use of each binary looks like in your environment.

Nobody can ship you that baseline, because normal rundll32.exe use depends on what software you installed.

Volt Typhoon is the documented case: four built-in Windows utilities, wmic, ntdsutil, netsh and PowerShell, and an intrusion recorded as evading both EDR products and standard logging configurations.

The attacker’s cost fell because nothing needed to be developed.

The defender’s cost rose because everything needed to be logged and baselined.

“We have EDR on the Installation box” is not the same claim as “we can see this.”

4. “But ATT&CK Is Just a Longer Kill Chain.”

It is not.

And using the two as synonyms is how the kill chain’s assumption sneaks back in under a newer name.

The kill chain has seven stages.

ATT&CK v19’s Enterprise matrix has 15 tactics.

Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact.

Each tactic is a goal, the adversary’s why.

Not a checkpoint the adversary must clear before the next one opens.

Nothing in ATT&CK requires sequential progression.

The kill chain treats an intrusion as one adversary running one linear campaign against one target.

ATT&CK treats it as a population of behaviours that can recur, repeat, or be skipped.

The clearest example is Valid Accounts.

It is tagged to four tactics simultaneously.

A single technique that serves four goals at once cannot sit in one position of a seven-step line.

Read the matrix left to right as a checklist and you have converted a non-linear model back into a linear one.

The matrix’s column order is a layout.

It is not a timeline.

The labels themselves are a modelling choice made by one organization and revised on its schedule.

MITRE is a nonprofit, and ATT&CK is free and openly licensed.

Industry adoption is why a T-number reads as canonical.

Not any authority that compels an intrusion to follow it.

5. “But We Mapped a Control to Every Tactic.”

Good.

You now have fifteen rows instead of seven.

You still have a list of adversary goals, not a list of your system’s parts.

A tactic mapping answers “what might an adversary be trying to do.”

It does not answer “which of our components, data flows and boundaries did anyone examine.”

Those are different questions.

The second one is the one your plan claims to have answered.

Ask to see the artifact.

For a per-stage or per-tactic plan there is none.

There is a table of goals with a product name beside each.

Nothing in it enumerates the check surface.

So “did we think of everything” gets answered by the reviewers’ collective memory of past incidents rather than by anything that can be counted.

That is the same gap an ad hoc component review has.

One reviewer, or one small group, looks at each piece and judges whether it seems secure.

The judgment is real.

There is no structural guarantee that every place worth checking was checked.

Threat modelling closes that gap by changing the object.

The UK NCSC says a threat model should include all components of the system, users included, all data flows between them, any interconnectivity to other systems and services, and any trust boundaries across which data flows.

OWASP’s process draws the trust boundary on the diagram wherever the level of trust changes.

Once that inventory exists, coverage is a walk over every element and every boundary.

A task with a countable end.

A seam between two subsystems that each look fine alone cannot be skipped, because the boundary had to be drawn before the diagram was finished.

STRIDE then gives each stop a fixed checklist, one violated property per letter, instead of a brainstorm.

A tactic list cannot do that.

It does not know your diagram exists.

6. “But Threat-Modelling Workshops Are Too Expensive to Run on Every System.”

Look at what one costs.

Microsoft’s worked example of a first threat-modelling exercise used three people.

A developer.

A program manager.

A tester.

Two meetings.

The reviewer spent 10 minutes walking the team through the process.

Within five minutes of turning to the diagram, an important missing component had been identified.

The second meeting handled threat review and sign-off.

That is the cost the plan is avoiding.

Two short meetings, with the people who already know what the system is meant to do.

NCSC describes the practice as a workshop drawing on exactly those people, not security specialists alone.

The cost scales with who is in the room and how many elements are on the diagram, both of which you choose.

The tooling does not force the number up.

A whiteboard and a spreadsheet cost nothing beyond the meeting.

OWASP Threat Dragon is free and open source under Apache 2.0, and supports STRIDE modelling directly.

The Microsoft Threat Modeling Tool has been a free download since its 2018 general-availability release.

IriusRisk’s Community edition is free, capped at three active models; its Enterprise tier is quoted rather than published.

So the choice is not between a workshop and nothing.

It is between two meetings per system and a control plan that has never been checked against the system at all.

7. No, This Does Not Mean Stage Models Are Useless.

They are not.

The kill chain is a teachable narrative.

It gives a new analyst a plain vocabulary for one delivery-driven intrusion.

ATT&CK is a shared vocabulary for behaviour.

A technique identifier means the same thing to your detection engineer, your incident responder and your vendor, which is worth a great deal.

The error is asking either of them for a guarantee it never offered.

Neither guarantees that a stage will occur.

Neither enumerates your system’s elements and boundaries.

Use them to describe what an adversary does.

Use a model of your own system to decide where you checked.

8. What You Should Actually Do

Map controls to ATT&CK techniques, and name the log source each depends on. Not to kill-chain boxes.

A control mapped to a behaviour, with the log it needs written beside it, can be checked.

A control mapped to “Installation” cannot.

Test from valid accounts, mid-matrix. Do not start every exercise at delivery.

Start with an identity that already authenticates, at Lateral Movement, and see which of your controls ever notice.

Enable and retain command-line and script-block logging. Then baseline normal use of the signed system binaries in your own environment.

Without both, living-off-the-land execution has nothing to trip.

Confirm your logging can see credential reuse. Pass the Hash is a second-stage technique: it needs local administrative access on some host to dump an NTLM hash before the hash can be reused, so it never shows up as an opening move a delivery control could catch.

For Pass the Hash, T1550.002, one narrow query correlates LogonType 3 NTLM authentications against the absence of a matching Kerberos ticket request.

The query is simple.

The logging it needs, on domain controllers and endpoints, is off by default in most organizations.

Low in query complexity, high in required coverage.

Check the coverage before you trust the query.

Do not treat exfiltration as one box either. Classic DNS over UDP caps a message at 512 bytes, so DNS tunnelling, T1071.004, is slow, chunked and strange up close.

Exfiltration through an already-authorized cloud storage service is fast and looks like an ordinary upload.

Different channels, different signals.

Threat-model each system against its own diagram. Record which elements and which boundaries were walked.

That record is the artifact a per-stage plan never produces.

Date the counts. Fifteen tactics, twenty-two Initial Access entries and a 31% exploitation share are dated evidence.

Recheck them before they go in a decision.

9. The Actual Model Is Not Complicated.

A stage model says how an adversary might sequence behaviour.

ATT&CK says the sequence is optional.

A threat model says what your system is, and where its trust changes.

A control plan has to answer to the third, not the first.

An intrusion is not obliged to traverse every stage, so a per-stage control inventory is not coverage.

Keep the chain for teaching.

Keep the matrix for vocabulary.

Then draw your system, walk every element and boundary on it, and write down that you did.