Attack Lifecycles and Threat Modeling

Introduction

Cyberattacks rarely occur as a single action. A capable adversary normally progresses through a sequence: selecting a target, obtaining access, establishing control, pursuing objectives, and attempting to avoid detection. Understanding this sequence helps defenders identify where an attack can be interrupted and which controls should be improved.

Attack lifecycle models provide structured ways to describe hostile activity. The Cyber Kill Chain presents a relatively linear sequence of adversary operations. MITRE ATT&CK provides a detailed knowledge base of adversary tactics and techniques. Attack trees represent how an attacker can combine alternative or complementary actions to achieve a goal. STRIDE supports threat modeling during system design by classifying common categories of security threat.

These frameworks are not competing descriptions of exactly the same thing. They operate at different levels. The Cyber Kill Chain emphasizes campaign progression, ATT&CK emphasizes observable adversary behavior, attack trees emphasize goal decomposition, and STRIDE emphasizes design-time security analysis. Used together, they help analysts understand attack paths, prioritize defensive opportunities, and communicate risk to technical and non-technical stakeholders.

Learning Objectives

By the end of this chapter, you should be able to:

• explain the purpose and limitations of attack lifecycle models;
• describe the seven stages of the Cyber Kill Chain;
• distinguish MITRE ATT&CK tactics, techniques, sub-techniques, and procedures;
• construct and interpret a basic attack tree;
• apply STRIDE to identify threats in a system design;
• map attack behaviors to defensive controls and detection opportunities;
• analyze an attack scenario using more than one framework; and
• recognize ethical, governance, and operational limitations of threat modeling.

1. Attack Lifecycles as Defensive Models

An attack lifecycle is a conceptual representation of how hostile activity develops over time. It is not a claim that every attack follows a fixed order. Real attacks may skip stages, repeat earlier activities, operate in parallel, or begin with access already obtained through a supplier or compromised account.

The value of a lifecycle model is analytical. It encourages defenders to ask:

1. What must the adversary accomplish?
2. What evidence might each activity create?
3. Which preventive, detective, or corrective control could disrupt it?
4. If prevention fails, where can the attack be contained?

A lifecycle is therefore best understood as a map of defensive opportunities rather than a prediction of exact attacker behavior.

Prevention, detection, response, and recovery

Controls can be aligned with different points in an attack:

Effective security uses layers. A control that prevents exploitation may fail because of a newly discovered vulnerability. Detection and response controls then provide additional opportunities to limit damage.

2. The Cyber Kill Chain

The Cyber Kill Chain was developed by Lockheed Martin as a model of intrusion activity. Its seven stages are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.

2.1 Reconnaissance

Reconnaissance involves collecting information about a target. Public information may include domain names, employee roles, technologies, exposed services, supplier relationships, and organizational structure. Technical reconnaissance can identify reachable systems and service characteristics.

Defensive opportunities include reducing unnecessary public exposure, monitoring brand and domain abuse, limiting technical information in public documents, and training staff to recognize targeted social engineering. Reconnaissance is not always visible to the target, especially when publicly available information is used.

2.2 Weaponization

Weaponization is the preparation of a malicious capability, such as a document containing exploit code or a package designed to deliver malware. The attacker generally combines a payload with a delivery mechanism.

This stage may occur outside the victim environment, so direct detection is often difficult. Defensive emphasis should therefore include secure email gateways, application allow-listing, attachment analysis, vulnerability management, and user awareness.

2.3 Delivery

Delivery is the transmission of the malicious capability to the target. Common channels include email, web downloads, removable media, messaging platforms, exposed services, and compromised software suppliers.

Useful controls include filtering, sandboxing, blocking dangerous file types, restricting removable media, enforcing software supply-chain assurance, and monitoring unusual inbound traffic.

2.4 Exploitation

Exploitation occurs when a vulnerability, configuration weakness, or human action enables unauthorized execution or access. The weakness may exist in software, identity processes, web applications, or organizational procedures.

Patch management is important but not sufficient. Compensating controls such as network segmentation, least privilege, input validation, application isolation, and multifactor authentication can reduce the effect of successful exploitation.

2.5 Installation

Installation establishes a persistent or repeatable presence. Examples include malicious services, scheduled tasks, altered startup configurations, unauthorized accounts, or modified cloud resources.

Endpoint integrity monitoring, application control, restricted administrative privileges, secure boot mechanisms, and centralized configuration management help reduce this risk.

2.6 Command and control

Command and control, often abbreviated C2, is the communication channel through which an adversary manages compromised systems. The channel may use web protocols, DNS, remote-access tools, cloud services, or other legitimate-looking infrastructure.

Defenders can examine destination reputation, domain age, beaconing patterns, unusual authentication, encrypted traffic metadata, and endpoint processes. Blocking all encrypted or cloud-based traffic is usually impractical; detection must combine multiple signals with context.

2.7 Actions on objectives

The final stage concerns the attacker’s purpose. Objectives may include theft of data, financial fraud, disruption, espionage, extortion, unauthorized resource use, or destruction.

The same compromise may support different objectives. Consequently, defenders should protect high-value assets directly through data classification, access controls, backups, transaction monitoring, and business continuity planning.

Strengths and limitations of the Kill Chain

The model is easy to communicate and encourages defense in depth. It is particularly useful for discussing where an intrusion might be interrupted. However, its linear structure can oversimplify modern attacks. An attacker may obtain valid credentials without delivering malware, begin with a supply-chain compromise, or move laterally before establishing conventional command and control. The model should therefore be combined with more behaviorally detailed approaches.

3. MITRE ATT&CK

MITRE ATT&CK is a knowledge base of adversary behaviors derived from public reporting and other evidence. It organizes activity into tactics, techniques, sub-techniques, and procedures.

Tactics

Tactics describe the adversary’s objective or reason for acting. Examples include Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

A tactic answers the question: “Why is the adversary performing this activity?”

Techniques and sub-techniques

A technique describes a general method used to achieve a tactical objective. A sub-technique provides greater specificity. For example, credential access may involve several distinct methods, each requiring different telemetry and controls.

A technique answers: “How can the adversary achieve this objective?”

Procedures

Procedures are concrete examples of how a technique has been used by a particular threat group, malware family, or campaign. Procedures are valuable because they connect abstract behavior to observable activity, but they are not exhaustive. The absence of a documented procedure does not prove that an adversary cannot use a technique.

Using ATT&CK defensively

ATT&CK can support:

• threat-informed security architecture;
• detection engineering and event-source selection;
• adversary emulation and purple-team exercises;
• incident investigation and reporting;
• control-gap analysis; and
• communication between security operations and management.

A useful workflow is to identify the likely threat actor or threat behavior, select relevant tactics and techniques, determine what evidence would be generated, and map each behavior to preventive and detective controls. Analysts should avoid treating ATT&CK technique coverage as a simple score. A control may detect one implementation of a technique but miss another, and a technique may be difficult to observe without appropriate logging.

Kill Chain and ATT&CK compared

The models can be combined: the Kill Chain can show broad progression, while ATT&CK can describe the specific behaviors occurring within each phase.

4. Attack Trees

An attack tree is a hierarchical representation of how an attacker might achieve a defined goal. The root node states the ultimate objective. Lower-level nodes represent intermediate goals and actions.

Two logical relationships are especially important:

• OR: any one child path may achieve the parent goal;
• AND: all specified child conditions are required, or must be combined, to achieve the parent goal.

For example, the root goal “gain unauthorized access to an employee account” may be achieved through an OR relationship involving password guessing, credential theft, or phishing. A phishing path might require an AND relationship between delivering a convincing message and obtaining the victim’s authentication material.

Attack trees are useful because they reveal alternative paths. Defending only against the most obvious path may leave another path open. The method also supports discussions of assumptions, required capabilities, and defensive investment.

Constructing an attack tree

A practical process is:

1. define one specific attacker goal;
2. identify major intermediate goals;
3. decompose each goal into actions or conditions;
4. mark logical relationships as AND or OR;
5. identify required privileges, access, tools, and dependencies;
6. attach preventive and detective controls to relevant nodes; and
7. validate the tree with technical and business stakeholders.

A tree should not become an unbounded list of every imaginable action. Its purpose is to support a decision, such as protecting a payment process or reducing the likelihood of unauthorized access to a cloud tenant.

Simple illustrative tree

Goal: Exfiltrate confidential customer data

• Obtain access to the environment (OR)
• Steal a privileged credential
• Exploit an exposed application
• Abuse a trusted supplier connection
• Locate the data (AND with access)
• Discover database or file locations
• Obtain permissions to read the data
• Transfer the data (OR)
• Use an approved cloud service
• Send it through an external connection
• Copy it to removable media

This representation highlights different defensive opportunities: identity protection, application security, supplier assurance, authorization, data loss prevention, egress monitoring, and removable-media controls.

Attack trees can be extended with cost, skill, time, or probability estimates, but such estimates should be treated cautiously. They often depend on uncertain assumptions and may create false precision.

5. STRIDE Threat Modeling

STRIDE is a mnemonic for six categories of security threat:

STRIDE is commonly applied to data-flow diagrams. The analyst identifies processes, data stores, data flows, external entities, and trust boundaries, then asks which STRIDE threats could affect each element.

Applying STRIDE step by step

Consider a web application in which a customer uses a browser to submit an order to an application server. The server reads product data from a database and sends payment information to an external payment provider.

A STRIDE analysis might identify:

• Spoofing: an attacker uses stolen customer credentials;
• Tampering: order values are altered between the browser and server;
• Repudiation: the organization cannot determine who approved a transaction;
• Information disclosure: payment or customer data is exposed in logs;
• Denial of service: repeated requests exhaust application resources; and
• Elevation of privilege: a customer account accesses administrative functions.

Possible mitigations include multifactor authentication, server-side authorization, transport protection, signed or carefully validated transactions, tamper-resistant audit logs, rate limiting, resource quotas, and strict separation of administrative roles.

STRIDE is strongest when performed early, while architecture can still be changed. It can also be revisited when new interfaces, data flows, identities, or trust relationships are introduced.

Threat modeling and trust boundaries

A trust boundary is a point where data or control moves between components with different levels of trust. Examples include a browser-to-server connection, an internal network-to-cloud connection, or an application-to-payment-provider interface. Boundaries deserve attention because assumptions about identity, validation, authorization, and data integrity may change at them.

6. Integrating the Frameworks

The frameworks become more valuable when used together. Consider a fictional online retailer that experiences unauthorized access to a cloud administration account.

The Cyber Kill Chain may describe the broad sequence as reconnaissance, delivery of a convincing message, exploitation of a human trust relationship, installation of a persistence mechanism, command and control through a legitimate cloud service, and actions on objectives such as data access.

ATT&CK can provide more precise behavior categories, including phishing, valid-account use, account manipulation, cloud-service discovery, and data collection. The exact mapping should depend on the observed facts rather than assumptions.

An attack tree can represent the attacker’s goal of accessing sensitive customer records. It may show alternative routes through stolen credentials, application exploitation, or supplier access.

STRIDE can examine the retailer’s architecture and expose spoofing at the identity layer, information disclosure in logging, elevation of privilege in administrative APIs, and tampering in order-processing requests.

The resulting defensive plan could include phishing-resistant multifactor authentication, conditional access, privileged access management, centralized audit logging, cloud configuration monitoring, segmentation, secure software development, and tested recovery procedures.

7. Applied Case: Illustrative Cloud Account Compromise

Background

This fictional case concerns Northbridge Retail, a medium-sized online retailer. Its administration environment uses a cloud identity provider, a web application, managed databases, and several external service providers. Administrators can manage application infrastructure from the public internet.

Problem

A finance administrator receives a realistic message directing them to a counterfeit sign-in page. The attacker obtains the administrator’s password and uses the account to access the cloud console. The organization has multifactor authentication for some users but not for all privileged accounts. Logging exists, but cloud identity events are not centrally reviewed.

Analysis using the Cyber Kill Chain

Reconnaissance identifies administrative roles and the organization’s cloud provider. Delivery occurs through a targeted message. Exploitation is achieved through credential theft rather than a software vulnerability. Installation may consist of creating a new access key or changing a federation rule. Command and control occurs through ordinary cloud access. The objective is to locate and copy customer information.

This example demonstrates why the Kill Chain should not be interpreted as requiring malware. Credential-based attacks can progress through equivalent operational stages.

Analysis using ATT&CK concepts

The relevant behaviors may include phishing, valid-account use, additional cloud account manipulation, discovery of cloud resources, collection of data, and exfiltration through an approved service. Investigators would confirm the exact behaviors from identity logs, access-key records, API activity, endpoint evidence, and data-access patterns.

Analysis using an attack tree

The attacker’s goal is “access customer data.” Alternative branches include:

• compromise a privileged cloud identity;
• exploit the public web application; or
• abuse a trusted supplier connection.

The first branch depends on obtaining credentials and bypassing or avoiding strong authentication, then discovering the relevant data store and obtaining permissions. This shows that identity security alone is not enough; authorization and data-layer monitoring are also required.

Approach and solution

Northbridge should immediately disable the suspected account, revoke active sessions and access keys, preserve logs, identify unauthorized changes, and assess whether data was accessed or copied. Longer-term improvements include phishing-resistant multifactor authentication for privileged users, just-in-time administration, separate administrative accounts, conditional access policies, centralized cloud logging, alerts for unusual administrative actions, and regular review of data permissions.

The retailer should also test whether backups are isolated and restorable, notify affected parties when legally required, and document the incident for governance and learning purposes.

Outcome and learning points

The central lesson is that the same incident can be understood at several levels. The Kill Chain explains progression, ATT&CK structures observable behavior, the attack tree reveals alternative routes, and STRIDE identifies architectural weaknesses. Together they produce a more complete defensive assessment than any single model.

8. Operational Practice and Governance

Threat modeling must be connected to ownership and action. Each identified threat should have an accountable owner, a proposed treatment, a monitoring method, and a review date. Teams should distinguish between a threat, a vulnerability, a risk, an event, and an incident:

• a threat is a potential cause of harm;
• a vulnerability is a weakness that can be exploited;
• a risk combines the possibility of harm with its consequences;
• an event is an observable occurrence; and
• an incident is an event that requires response because it compromises or threatens security.

Threat models must also respect authorization and privacy. Security testing should be approved, scoped, and conducted without unnecessary collection of personal data. Attack paths should not be used as instructions for unauthorized intrusion. Documentation should protect sensitive architectural information and should be shared according to role and need.

Regulatory obligations may influence logging, retention, breach notification, access governance, and data protection. Organizations should consult applicable laws, contracts, and sector requirements rather than assuming that a technical framework itself establishes compliance.

9. Limitations and Contemporary Developments

No framework guarantees prevention. Models depend on accurate assumptions, complete system knowledge, reliable telemetry, and regular updating. Cloud services, mobile devices, software suppliers, identity federation, operational technology, and artificial intelligence can create paths not represented in an older model.

Artificial intelligence can assist with log summarization, anomaly detection, attack-path generation, and mapping reports to ATT&CK. However, automated outputs require human validation. AI systems may produce inaccurate mappings, overlook business context, expose sensitive data to external services, or amplify biased assumptions. They should support—not replace—analyst judgment and governance.

Contemporary practice increasingly emphasizes identity-centric defense, attack-surface management, exposure validation, continuous control monitoring, and adversary emulation. These approaches complement lifecycle models by testing whether controls work in the actual environment rather than merely documenting their existence.

Best Practices

• Begin with a clearly defined business or technical objective.
• Use more than one model when the problem involves both architecture and active adversary behavior.
• Record assumptions and distinguish facts from hypotheses.
• Prioritize high-value assets, identities, trust boundaries, and business processes.
• Map controls to prevention, detection, response, and recovery.
• Prefer high-quality telemetry over large volumes of unreviewed logs.
• Test controls through authorized exercises.
• Revisit models after major technology, supplier, or process changes.
• Avoid treating framework coverage as proof of security.
• Assign owners and deadlines for material findings.

Chapter Summary

Attack lifecycle and threat-modeling frameworks help defenders reason about how adversaries achieve objectives and where attacks can be interrupted. The Cyber Kill Chain describes broad stages from reconnaissance through actions on objectives. MITRE ATT&CK provides a detailed vocabulary of adversary tactics, techniques, sub-techniques, and procedures. Attack trees decompose an attacker goal into alternative and combined paths. STRIDE classifies design threats involving spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege.

These frameworks are most effective when integrated. A lifecycle model explains progression, ATT&CK supports behavior-based detection, attack trees expose alternative routes, and STRIDE strengthens architecture and design review. None is complete by itself. High-quality threat modeling depends on explicit assumptions, reliable evidence, appropriate governance, human judgment, and continuous review.

Key Terms

Attack lifecycle: A conceptual sequence representing how hostile activity progresses.

Cyber Kill Chain: A seven-stage model of intrusion activity.

Reconnaissance: Collection of information about a target.

Delivery: Transmission of a malicious capability to a target.

Exploitation: Use of a weakness to obtain unauthorized access or execution.

Persistence: Methods used to retain access across sessions or restarts.

Command and control: Communication used to manage compromised systems.

MITRE ATT&CK: A knowledge base of adversary tactics and behaviors.

Tactic: The adversary’s operational objective.

Technique: A general method used to achieve a tactical objective.

Sub-technique: A more specific form of a technique.

Procedure: A concrete example of technique use.

Attack tree: A hierarchical model of paths to an attacker goal.

AND relationship: A relationship requiring multiple child conditions or actions.

OR relationship: A relationship in which alternative child paths may achieve a goal.

STRIDE: A threat-classification mnemonic covering six major threat categories.

Trust boundary: A point where data or control crosses between different trust domains.

Threat model: A structured representation of threats, assumptions, assets, and controls.

Defense in depth: Use of multiple complementary security controls.

Valid-account abuse: Use of legitimate credentials for unauthorized activity.

Review Questions

Short Answer Questions

1. What is the main purpose of an attack lifecycle model?
2. Name the seven stages of the Cyber Kill Chain.
3. What is the difference between an ATT&CK tactic and a technique?
4. Explain the difference between an AND and an OR relationship in an attack tree.
5. What security concern does STRIDE’s “Elevation of privilege” category address?

Long Answer Questions

1. Compare the Cyber Kill Chain and MITRE ATT&CK in terms of structure, purpose, and limitations.
2. Explain how an attack tree can reveal defensive opportunities that a simple linear lifecycle may overlook.
3. Describe a practical STRIDE analysis for a web application that stores personal information.
4. Explain how prevention, detection, response, and recovery controls can be aligned with an attack lifecycle.
5. Discuss why valid-account attacks may progress through a Kill Chain even when no malware is installed.

Analytical / Application Questions

1. A cloud administrator’s credentials are stolen through phishing. Construct a short attack tree showing at least two alternative paths to access confidential data, and identify one control for each path.
2. Given a system with a browser, application server, database, and external payment provider, identify one plausible STRIDE threat at each trust boundary and propose a mitigation.
3. An organization has endpoint protection but weak cloud logging. Use the Cyber Kill Chain and ATT&CK concepts to explain which defensive opportunities may remain unaddressed.

Multiple Choice Questions with Answers

Question 1

Which Cyber Kill Chain stage concerns collecting information about a target?

A. Reconnaissance

B. Installation

C. Command and control

D. Actions on objectives

Correct Answer: A. Reconnaissance

Question 2

In MITRE ATT&CK, what does a tactic primarily describe?

A. A specific malware family

B. The adversary’s operational objective

C. A firewall configuration

D. A forensic evidence format

Correct Answer: B. The adversary’s operational objective

Question 3

In an attack tree, an OR relationship means that:

A. All child actions must occur simultaneously

B. Only defensive actions are represented

C. Any one suitable child path may achieve the parent goal

D. The parent goal is impossible to achieve

Correct Answer: C. Any one suitable child path may achieve the parent goal

Question 4

Which STRIDE category concerns pretending to be another entity?

A. Tampering

B. Spoofing

C. Repudiation

D. Denial of service

Correct Answer: B. Spoofing

Question 5

Which activity is most closely associated with the Command and Control stage?

A. Preparing a malicious document

B. Gathering public information

C. Managing a compromised system through a communication channel

D. Classifying business data

Correct Answer: C. Managing a compromised system through a communication channel

Question 6

Why should ATT&CK technique coverage not be treated as proof of security?

A. ATT&CK contains no techniques

B. A control may detect one implementation but miss another

C. Techniques apply only to physical security

D. ATT&CK replaces incident response

Correct Answer: B. A control may detect one implementation but miss another

Question 7

Which STRIDE category primarily affects confidentiality?

A. Information disclosure

B. Elevation of privilege

C. Spoofing

D. Denial of service

Correct Answer: A. Information disclosure

Question 8

What is a trust boundary?

A. A location where data or control crosses between different trust domains

B. A password complexity rule

C. A type of malware signature

D. A backup storage format

Correct Answer: A. A location where data or control crosses between different trust domains

Question 9

Which control is most directly associated with limiting unauthorized cloud administrative access?

A. Phishing-resistant multifactor authentication

B. Removing all system logs

C. Disabling data classification

D. Allowing shared administrator accounts

Correct Answer: A. Phishing-resistant multifactor authentication

Question 10

Why are multiple threat-modeling frameworks often used together?

A. Each framework describes exactly the same information

B. They provide complementary views of progression, behavior, goals, and design threats

C. Using one framework is prohibited

D. They eliminate the need for security controls

Correct Answer: B. They provide complementary views of progression, behavior, goals, and design threats