The-Unified-Kill-Chain.pdf

The Unified Kill Chain – a white paper by Paul Pols

The Unified Kill Chain

R A I S I N G R E S I L I E N C E A G A I N S T A D V A N C E D C Y B E R A T T A C K S

Paul Pols

The Unified Kill Chain – a white paper by Paul Pols

Unified Kill Chain (UKC) model is presented that details the tactics that form the building blocks of

modern cyber attacks by Advanced Persistent Threats (APTs) as well as ransomware groups. The

Unified Kill Chain provides insights into the ordered arrangement of phases in attacks from their

beginning to their completion, by uniting and extending existing models. The Unified Kill Chain can be

used to analyze, compare and defend against targeted and non-targeted cyber attacks.

Research shows that the traditional Cyber Kill Chain® (CKC), as

presented by researchers of Lockheed Martin, is perimeter- and

malware-focused. As such, the traditional model fails to cover other

attack vectors and attacks that occur behind the organizational

perimeter. The Unified Kill Chain offers significant improvements over

of threat actors.

The case studies that were performed also falsify a crucial assumption

underlying traditional kill chain models, namely that attackers must

progress successfully through each phase of a deterministic sequence.

The observation that attack phases may be bypassed affects defensive

strategies fundamentally, as an attacker may also bypass the security

controls that apply to these phases. Instead of focusing on thwarting

attacks at the earliest point in time, layered defense strategies that

focus on attack phases that occur with a higher frequency or that are

vital for the formation of an attack path are thus expected to be more successful. These insights

and intelligence to develop and realign defense strategies in an attempt to raise the resilience of

organizations and societies against this dangerous trend.

Keywords — Unified Kill Chain, Cyber Security, Strategy, Attack Modeling, Attack Simulation, Threat

Emulation, Cyber Kill Chain®, MITRE ATT&CK™, Red Team, Tactics, Techniques, Procedures, Assume

Breach, Defense in Depth, APT, ransomware.

#

Unified Kill Chain

6

Persistence

7

Defense Evasion

8

Command & Control

9

Pivoting

Discovery

Execution

The Unified Kill Chain – a white paper by Paul Pols

1 Introduction ..................................................................................................................................... 4

2 Design of the Unified Kill Chain ....................................................................................................... 5

3 Phases of the Unified Kill Chain ....................................................................................................... 6

3.1 Overview of the attack phases ................................................................................................ 6

3.2 In .............................................................................................................................................. 7

3.3 Through ................................................................................................................................... 8

3.4 Out ........................................................................................................................................... 9

4 Using the Unified Kill Chain ........................................................................................................... 10

4.1 Modeling specific cyber attacks and threat actors ............................................................... 10

4.2 Realigning defensive strategies ............................................................................................. 11

The Unified Kill Chain – a white paper by Paul Pols

increasingly threaten critical activities that depend on ICT within organizations and society as a

whole. Organizations need to protect their critical assets against a variety of threat actors that range

from cyber criminals to nation states.

To properly defend oneself against advanced cyber attacks, one must first understand how these

attacks are typically performed. For this purpose, threat modeling is required [1]. The Cyber Kill

Chain® by Lockheed Martin (CKC) was traditionally regarded as the industry standard threat model

for defending against advanced cyber attacks [2]. Despite (or because of) its prominent status, the

CKC has been widely criticized. The most damaging criticisms argue that the CKC is perimeter- and

malware-focused [3]. A more comprehensive model is required to deal with advanced cyber attacks

beyond the organizational perimeter and beyond malware attacks.

The term “kill chain” describes an end-to-end process [2], or the entire chain of events, that is

required to perform a successful attack. Once an attack is understood and deconstructed into

discrete phases, it allows defenders to map potential countermeasures against each one of these

phases. Kill chain and other attack lifecycle models, can thus help defenders understand and defend

against the increasingly complex attacks that they are facing. Advanced cyber attacks typically extend

beyond exploiting one vulnerability in an internet-connected system. Depending on the security

posture of the target, attacks may require attackers to forge an attack path through the internal

network of the victim, in which multiple correlated vulnerabilities are exploited before critical assets

can be targeted and objectives can be achieved.

ransomware worms, that implement tactics that were previously primarily seen in targeted attacks.

As such, the Unified Kill Chain has a proven track recording in raising the resilience of targeted

organizations against a range of targeted and (initially) untargeted attacks.

The Unified Kill Chain offers a substantiated basis for strategically realigning defensive capabilities

and cyber security investments within organizations, in the areas of prevention, detection, response

and intelligence. The Unified Kill Chain allows for a structured analysis and comparison of threat

intelligence regarding the tactical modus operandi of attackers. In the area of prevention, the Unified

Kill Chain can be used to map countermeasures to the discrete phases of an attack. Detection can be

prioritized based on the insights into the ordered arrangement of the attack phases. In emergency

response situations, the Unified Kill Chain aids investigators in triage and modeling likely attacks