Offensive Security 101: The Attack Lifecycle: A Hacker’s Day Planner

Author: Tech Corsair | Category: Offensive Security | Reading Time: ~12 minutes

Every successful cyberattack follows a pattern. Not in the "serial killer leaving calling cards" sense (though some APT groups do enjoy a good signature), but in the structured, methodical sense that security researchers have spent decades documenting, categorising, and turning into frameworks with increasingly serious-sounding names.

Understanding how attacks unfold is fundamental to both offensive and defensive security. Whether the goal is simulating attacks during authorised penetration tests or building detection capabilities, three frameworks dominate the conversation: Lockheed Martin's Cyber Kill Chain, the MITRE ATT&CK Framework, and the Diamond Model of Intrusion Analysis.

Think of them as three different lenses on the same ugly photograph. Each reveals something the others miss.

The Cyber Kill Chain: A To-Do List Nobody Wants to Be On

Back in 2011, Lockheed Martin's clever people published a paper that essentially said: "What if we treated cyberattacks like military operations?" The result was the Cyber Kill Chain -- a seven-phase model describing the progression of an intrusion from initial reconnaissance to mission completion.

It is, in effect, a hacker's to-do list. And nobody wants to be on the receiving end of someone ticking off every box.

Phase 1: Reconnaissance

The attacker picks a target and starts gathering intelligence. This includes passive activities like scraping LinkedIn for employee names, harvesting email addresses from public sources, and identifying technology stacks from job postings. ("Must have experience with Fortinet FortiGate" is basically a treasure map for attackers.)

Phase 2: Weaponisation

Armed with reconnaissance data, the attacker crafts a deliverable payload. This might mean embedding a reverse shell in a macro-enabled Word document, packaging an exploit into a PDF, or building a trojanised application. The victim never sees this phase -- it happens entirely in the attacker's workshop.

Phase 3: Delivery

The weapon needs to reach the target. Common delivery mechanisms include phishing emails (still the reigning champion, year after year), compromised websites (watering hole attacks), and USB drives left in car parks for the curious. The delivery mechanism is limited only by creativity and the target's attack surface.

Phase 4: Exploitation

The payload fires. A vulnerability is exploited -- whether that is a software bug, a misconfiguration, or the ever-reliable "human clicks thing they shouldn't." This is the moment the attacker's code begins executing on the target system.

Phase 5: Installation

The attacker establishes persistence. Malware is installed, backdoors are planted, registry keys are modified, scheduled tasks are created. The goal is simple: survive a reboot. Nobody wants to go through all that effort only to lose access when someone restarts their laptop to install a Windows update.

Phase 6: Command and Control (C2)

The compromised system phones home, establishing a communication channel with the attacker's infrastructure. This might use HTTP/HTTPS traffic to blend in with normal web browsing, DNS tunnelling to hide in plain sight, or even social media platforms as dead drops. The attacker now has a remote control for the victim's environment.

Phase 7: Actions on Objectives

The endgame. Data exfiltration, ransomware deployment, lateral movement to higher-value targets, credential harvesting, or simply maintaining long-term access for espionage. This is where the attacker achieves whatever goal prompted the entire operation.

The defensive insight: Disrupting any single phase breaks the chain. A phishing email caught by a mail filter (delivery), an exploit blocked by patching (exploitation), or C2 traffic flagged by a firewall (command and control) -- each represents an opportunity to stop the attack dead.

MITRE ATT&CK: The Dewey Decimal System of Hacking

If the Kill Chain is a high-level overview, MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is the encyclopaedia. Launched in 2013 and continuously updated, ATT&CK catalogues real-world adversary behaviour into a structured matrix of tactics (the "why") and techniques (the "how").

Every technique gets a T-number -- a unique identifier like T1566 for Phishing or T1059 for Command and Scripting Interpreter. Think of T-numbers as the Dewey Decimal System of hacking: a universal cataloguing scheme that lets security professionals worldwide speak the same language. When a threat report references T1053.005, everyone knows that means Scheduled Task -- no ambiguity, no "well, what we mean by persistence is…"

ATT&CK's Enterprise matrix contains 14 tactics, arranged roughly in the order an adversary might use them:

1. Reconnaissance (TA0043)

Gathering information to plan the operation. Techniques include active scanning (T1595), searching open websites and domains (T1593), and gathering victim identity information (T1589). Essentially: professional-grade internet stalking.

2. Resource Development (TA0042)

Establishing the infrastructure and capabilities needed for the attack. This covers acquiring domains (T1583.001), compromising accounts (T1586), and developing or obtaining malware (T1587). The attacker's equivalent of a trip to B&Q before a home renovation -- except the renovation involves someone else's network.

3. Initial Access (TA0001)

Getting a foot in the door. Phishing (T1566), exploiting public-facing applications (T1190), valid accounts (T1078), and supply chain compromise (T1195). The SolarWinds incident demonstrated that T1195 can be devastatingly effective -- why break into one organisation when you can compromise the software they all trust?

4. Execution (TA0002)

Running malicious code. PowerShell (T1059.001), Windows Management Instrumentation (T1047), and user execution (T1204 -- otherwise known as "double-click and regret"). This tactic covers the mechanisms by which adversary-controlled code actually runs on a target system.

5. Persistence (TA0003)

Maintaining access across restarts and credential changes. Boot or logon autostart execution (T1547), scheduled tasks (T1053), account creation (T1136). An attacker without persistence is just a tourist.

6. Privilege Escalation (TA0004)

Moving from low-privilege access to something more useful. Exploitation for privilege escalation (T1068), access token manipulation (T1134), and the ever-popular abuse of elevation control mechanisms (T1548). Because Domain User is never the final destination.

7. Defence Evasion (TA0005)

Avoiding detection. Obfuscated files (T1027), indicator removal (T1070), masquerading (T1036), and disabling security tools (T1562). The largest tactic in ATT&CK by technique count, because staying hidden is rather important when someone's entire security operations centre is looking for you.

8. Credential Access (TA0006)

Stealing credentials. OS credential dumping (T1003 -- Mimikatz's bread and butter), brute force (T1110), input capture/keylogging (T1056), and Kerberoasting (T1558.003). Passwords: the gift that keeps on giving.

9. Discovery (TA0007)

Mapping the environment post-compromise. System information discovery (T1082), network share discovery (T1135), permission group discovery (T1069). The attacker is essentially running whoami, ipconfig, and net group "Domain Admins" with varying degrees of sophistication.

10. Lateral Movement (TA0008)

Moving between systems within the network. Remote services (T1021), exploitation of remote services (T1210), and lateral tool transfer (T1570). This is where an attacker turns a single compromised workstation into a network-wide problem.

11. Collection (TA0009)

Gathering target data for exfiltration. Data from local systems (T1005), email collection (T1114), screen capture (T1113). Everything interesting gets hoovered up and staged for extraction.

12. Command and Control (TA0011)

Establishing and maintaining communication with compromised systems. Application layer protocols (T1071), encrypted channels (T1573), proxy use (T1090). Modern C2 frameworks like Cobalt Strike and Mythic implement dozens of these techniques out of the box.

13. Exfiltration (TA0010)

Getting stolen data out. Exfiltration over C2 channel (T1041), exfiltration over web service (T1567 -- nothing suspicious about uploading 50GB to a cloud storage provider, surely), and exfiltration over alternative protocol (T1048).

14. Impact (TA0040)

Disruption, destruction, or manipulation. Data encryption for impact (T1486 -- ransomware), data destruction (T1485), defacement (T1491), and resource hijacking (T1496 -- cryptomining on someone else's hardware, the digital equivalent of stealing electricity).

The power of ATT&CK lies in its specificity. Rather than saying "the attacker moved laterally," a security team can say "the adversary used T1021.002 (SMB/Windows Admin Shares) for lateral movement, which we can detect by monitoring for anomalous authentication events on port 445." That precision transforms vague threat descriptions into actionable detection engineering.

The Diamond Model: Four Points of Clarity

While the Kill Chain describes attack progression and ATT&CK catalogues techniques, the Diamond Model of Intrusion Analysis (Caltagirone, Pendergast, and Betz, 2013) focuses on the relationships between the core components of any intrusion event.

The model defines four vertices -- and yes, they form a diamond:

                    Adversary
                   /         \
                  /           \
                 /             \
         Capability ----+---- Infrastructure
                 \             /
                  \           /
                   \         /
                     Victim

The Four Vertices

Adversary -- The threat actor or group conducting the operation. This could be a nation-state APT group, a financially motivated cybercrime syndicate, a hacktivist collective, or an insider. Attribution is notoriously difficult (and occasionally politically inconvenient), but understanding the adversary informs everything from motive assessment to predicted TTPs.

Capability -- The tools, techniques, and procedures (TTPs) the adversary employs. A zero-day exploit, a custom RAT, a commodity malware kit purchased from an underground forum, or simply a well-crafted phishing email. Capabilities range from "script kiddie with a YouTube tutorial" to "nation-state with a dedicated exploit development team."

Infrastructure -- The systems the adversary uses to deliver capabilities and maintain control. Command and control servers, phishing domains, compromised third-party websites, bulletproof hosting providers, VPN endpoints, and Tor exit nodes. Infrastructure is often the most observable and actionable vertex for defenders.

Victim -- The target of the intrusion. This encompasses the organisation, its people, its systems, and its data. Understanding the victim vertex means understanding why they were targeted -- whether for their intellectual property, financial assets, strategic position, or simply because they left RDP exposed to the internet.

Why Diamonds Are a Defender's Best Friend

The Diamond Model's elegance is in how it connects these vertices. Every intrusion event involves an adversary deploying a capability over infrastructure against a victim. By pivoting between vertices, analysts can expand their understanding of a threat:

• Found a malicious IP (infrastructure)? Search for other victims it targeted.
• Identified a malware sample (capability)? Look for other infrastructure it connects to.
• Know the adversary? Predict what capabilities and infrastructure they favour.
• Understand the victim? Assess which adversaries are likely interested and what capabilities they would deploy.

This pivot-and-expand approach is the backbone of threat intelligence analysis and threat hunting.

Mapping the Three Frameworks Together

These frameworks are not competitors -- they are complementary lenses, and understanding how they overlap produces a far more complete picture than any single model provides.

Kill Chain to ATT&CK

The Kill Chain's seven phases map broadly to ATT&CK's fourteen tactics:

The Kill Chain provides the narrative arc. ATT&CK fills in the granular detail at each stage. Together, they let a red team plan an engagement with strategic coherence (Kill Chain) and technical precision (ATT&CK technique selection).

Diamond Model as the Connective Tissue

The Diamond Model overlays onto both frameworks by providing context at every stage. At the Delivery phase (Kill Chain) or Initial Access tactic (ATT&CK), the Diamond Model asks: which adversary is deploying which capability through which infrastructure against which victim?

This contextualisation is what transforms raw indicators of compromise into actionable intelligence. A phishing email is not just a phishing email -- it is APT29 (adversary) using a macro-enabled document (capability) sent from a compromised email account (infrastructure) targeting a government contractor (victim). That context changes the response entirely.

Practical Application

In authorised red team operations, the combined framework approach works like this:

1. Plan the engagement using Kill Chain phases as milestones
2. Select techniques from ATT&CK for each phase based on the target environment
3. Document findings using Diamond Model relationships to provide clear, structured reporting

For blue teams, the mapping works in reverse:

1. Detect an indicator and place it in the Diamond Model
2. Map the technique to ATT&CK for detection engineering
3. Assess the Kill Chain phase to understand how far the intrusion has progressed and what comes next

---

Wrapping Up: Know Thy Enemy's Playbook

The attack lifecycle is not a mystery. It has been studied, documented, and categorised with the kind of thoroughness that would make a librarian weep with joy. The Cyber Kill Chain gives the strategic narrative, MITRE ATT&CK provides the technical encyclopaedia, and the Diamond Model connects the contextual dots.

For penetration testers operating under authorised engagements, these frameworks provide structure and rigour. For defenders, they provide a shared vocabulary and a detection roadmap. For everyone else, they provide a sobering look at just how systematic modern cyberattacks have become.

The bad news: attackers have a well-documented playbook. The good news: so do the defenders. The real question is who reads theirs more carefully.

---

All offensive techniques discussed in this article should only be performed during authorised security assessments with explicit written permission. Unauthorised access to computer systems is illegal in most jurisdictions and carries severe penalties.