What is the cyber kill chain, and how does it relate to MITRE ATT&CK?
The cyber kill chain is a model published by Lockheed Martin in 2011 that describes an intrusion in seven stages: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. Its message is that an attacker must succeed at every stage, while a defender only needs to break one. MITRE ATT&CK is more detailed and better suited to what happens after the first foothold, with many tactics and hundreds of techniques, so most teams use the kill chain to explain an attack to management and ATT&CK to plan detection. Both make the same practical point: attacks take steps, and each step is a chance to notice. For a small company, the later stages, command and control, movement inside the network and data leaving, are where network detection such as NetSenX adds the most.