Warmup Guide — The Attacker Lifecycle from First Principles (for Defenders)

Zero-to-expert primer for the Offensive Methodology module. It builds the whole attack, end to end, the way a penetration tester, red-teamer, threat hunter, or incident responder must understand it — the lifecycle (reconnaissance → initial access → execution → persistence → privilege escalation → lateral movement → collection → command-and-control → exfiltration → impact) and the three lenses that structure it (Cyber Kill Chain, Diamond Model, MITRE ATT&CK). Every offensive concept here ends in what telemetry it produces and how a defender breaks the chain. It is taught for defense and authorized testing: authorized-lab-only, no live targets, no payloads (Phase 00). The difference between an attacker and a defender is authorization and intent — not knowledge.

Table of Contents

Chapter 1: Why a Defender Learns the Whole Attack

Zero background. The other phases teach attacker techniques in isolation — a memory bug (P01), an SSRF (P02), an over-permissioned IAM role (P07). A real intrusion is a campaign: an attacker chains many small steps, over hours to months, from "I know nothing about this company" to "I have their data / their money / their operations." If you only understand the steps locally, you cannot answer the questions that matter on the job: how far along is this intrusion? what comes next? where is the cheapest place to stop it? what else is the same actor doing?

Why "the whole attack" is the unit of defense. Defense that fixes one technique is whack-a-mole; the attacker just picks another. Defense that understands the chain finds choke points — the few stages every campaign must pass through (initial access, privilege escalation, lateral movement, exfiltration) where one good control breaks many attack paths at once. The entire value of the frameworks in Chapter 2 is turning a pile of alerts into a campaign you can reason about and disrupt.

The professional roles this serves. A penetration tester / red-teamer executes this lifecycle (authorized, scoped) to prove risk. A threat hunter looks for it in telemetry before an alert fires. A detection engineer writes detections for its stages (P09). An incident responder reconstructs it after the fact (P09). A security architect designs controls at its choke points. All four think in the same lifecycle; this module is that shared model.

Misconception to kill now. "Learning attacks is for offensive roles only." You cannot detect, hunt, scope, or architect against a campaign you can't model end to end. Every defensive discipline runs on an internalized attacker lifecycle — that's why blue teams study ATT&CK and run purple-team exercises.

Chapter 2: The Three Lenses — Kill Chain, Diamond Model, ATT&CK

Three complementary models structure attacker behavior. They are not competitors; a mature analyst uses all three, each for what it's good at.

The Cyber Kill Chain (Lockheed Martin) — the linear campaign lens. Seven phases an intrusion-style attack passes through in order: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. Its value is earliness: the further left you detect and break the chain, the cheaper the defense and the less damage. It answers "how far along is this intrusion, and where do we cut it?" Its limit: it's linear and intrusion-centric — real attacks loop (re-recon after a foothold) and some (insider, supply chain) don't fit neatly.

The Diamond Model — the relational / intelligence lens. Every malicious event has four vertices: Adversary (who), Capability (the tool/technique/malware), Infrastructure (the IPs/domains/C2 they use), and Victim (the target). The power is pivoting: knowing one vertex lets you discover others — a C2 domain (infrastructure) leads to other victims contacting it, a malware sample (capability) leads to other infrastructure it talks to. It answers "what else is connected to this — same actor, same campaign?" and is the analytic core of threat intelligence and attribution. (Lab 03 builds exactly this pivot.)

MITRE ATT&CK — the behavioral catalog lens. A matrix of tactics (the adversary's goal at a stage — Initial Access, Persistence, Privilege Escalation, Lateral Movement, Exfiltration, …) and the techniques that achieve each (e.g. T1566 Phishing, T1078 Valid Accounts, T1021 Remote Services). It answers "what specific behavior is this, and do we have a detection for it?" ATT&CK is the shared vocabulary that ties the other two lenses to concrete, detectable actions (P09's coverage map).

How they compose (the mental model): the Kill Chain tells you where in the campaign you are; ATT&CK tells you what technique you're looking at within that phase; the Diamond Model tells you what else is related so you can scope the whole campaign. Lab 01 maps events onto Kill Chain + ATT&CK; Lab 03 pivots them with the Diamond Model.

Misconception to kill now. "ATT&CK replaced the Kill Chain." They operate at different altitudes — the Kill Chain is the sequence/strategy, ATT&CK is the technique taxonomy, the Diamond Model is the relationship graph. Strong analysts switch between all three.

Chapter 3: Reconnaissance and Attack-Surface Mapping

Zero background. Before touching a target, attackers learn it. Reconnaissance (ATT&CK tactic TA0043) splits into passive (no packets to the target — public sources) and active (probing the target, which generates logs and risk). The defender's mirror discipline is Attack-Surface Management (ASM): continuously discovering your own exposed assets before the attacker does.

Passive recon / OSINT (Open-Source Intelligence). Public data assembled into a target map: DNS and certificate transparency logs (every TLS cert is public — they leak subdomains and internal naming), WHOIS, search engines and code search (leaked secrets, internal hostnames in GitHub), job postings (revealing the tech stack), breach-data and credential dumps, social media (employee names → email format → phishing targets), and cloud-bucket/asset enumeration. None of it touches the target, so none of it is logged by them.

Active recon. Port/service scanning (nmap), service/version fingerprinting, web crawling, subdomain brute-forcing, and vulnerability scanning — all of which do hit the target and produce telemetry.

The defensive counter (break the chain at the earliest phase). You cannot stop OSINT, but you can shrink and monitor the surface it reveals: run your own ASM (subdomain/cert-transparency monitoring, external scanners, leaked-secret scanning of your repos — P03/P14), find and kill subdomain takeovers (a dangling DNS record pointing at a deprovisioned cloud resource an attacker can claim), minimize what job posts and error pages disclose, and rotate any secret that appears in a public source. Active recon is detectable — scan-pattern detections and honeypots (P09) catch it.

Misconception to kill now. "We're not interesting enough to be targeted." Recon is cheap and automated; mass scanners hit every IP on the internet continuously. Attack-surface discovery is a defensive must — the attacker is already enumerating you.

Chapter 4: Initial Access

Zero background. Initial Access (TA0001) is the attacker's first foothold inside the trust boundary. The dominant vectors, in rough order of real-world prevalence:

  • Phishing (T1566). A crafted email/message lures a user into running a payload, entering credentials on a fake page, or approving an MFA prompt. Business Email Compromise (BEC) is the high-value variant — no malware, just a convincing fraudulent instruction (often after From: spoofing — P02 Chapter 14). Phishing is the single most common initial-access vector.
  • Valid accounts (T1078). Logging in with real stolen/leaked/purchased credentials — the quietest entry, because it looks like a normal login. Credential stuffing, password spraying, and buying access from initial-access brokers all land here.
  • Exploit public-facing application (T1190). A vulnerable internet-exposed service — the web classes of P02, an unpatched VPN/appliance, a 1-day after a patch (P08 patch diffing).
  • Supply-chain compromise (T1195). Poison a dependency or the build so the victim ships the attacker's code (P14 — SolarWinds, xz).
  • External remote services / trusted relationship — abusing a VPN, RDP, or a third-party integration's access.

The defensive counter. This is a choke point — almost every campaign passes through it. Phishing-resistant MFA (FIDO2/WebAuthn passkeys, which can't be phished or MFA-fatigued) defeats the credential vectors; email authentication (SPF/DKIM/DMARC) and user reporting cut phishing; patch velocity and external attack-surface reduction cut T1190; SLSA/signing cut supply chain (P14). Detect impossible-travel logins, new-device/MFA anomalies, and first-seen processes after a document open.

Misconception to kill now. "We have MFA, so credentials are handled." Push/SMS MFA is phishable and fatigue-able (spam the user with prompts until they approve). Only phishing-resistant (WebAuthn/passkey) MFA closes the channel.

Chapter 5: Execution, Persistence, and Defense Evasion

Execution (TA0002). Running attacker code on the foothold. The modern hallmark is Living-off-the-Land (LOLBins) — abusing legitimate, signed system tools (PowerShell, wmic, certutil, rundll32, mshta, bash, python) so there's no malicious binary to flag. This is why P05/P09 emphasize command-line and script-block logging: the binary is trusted; the arguments betray the abuse.

Persistence (TA0003). Surviving reboots and credential changes so the foothold is durable: scheduled tasks/cron, new or modified accounts, services, run keys, startup items, SSH authorized_keys, cloud IAM users/keys, OAuth-app grants, and — most dangerous — identity persistence (a rogue federation trust, a golden/silver Kerberos ticket, a long-lived cloud access key). Identity persistence outlives any host rebuild.

Defense Evasion (TA0005). Hiding: disabling or blinding security tooling (AMSI bypass, ETW patching — P05), clearing/tampering logs, timestomping, obfuscation, and process injection (P08 — running in a trusted process's memory). The point for a defender is that mature attackers expect your tools and try to turn them off; tamper-evident, centralized, off-host logging (P00/P09) is what survives.

The defensive counter. Application allowlisting and constrained language modes raise the cost of execution; EDR behavioral detection catches LOLBin patterns (the parent-child process tree, the command line) even when each binary is trusted; persistence is caught by baselining (a new scheduled task, a new admin, a new OAuth grant is an event to alert on); and you monitor the monitors (a source that goes silent, AMSI disabled — P09 health alerts).

Misconception to kill now. "No malware was found, so there was no compromise." Living-off-the-land intrusions ship no malware — they abuse trusted tools and stolen credentials. Behavior, not binaries, is the signal.

Chapter 6: Privilege Escalation

Zero background. A foothold rarely lands with the privilege the attacker wants. Privilege Escalation (TA0004) is climbing from the access you have to the access you need, on three terrains:

  • Local (host). A setuid/sudo misconfiguration or a writable service binary on Linux (P05); an unquoted service path, token impersonation (SeImpersonate/"Potato" techniques), or a vulnerable driver on Windows; a kernel exploit (P01/P08) where memory-safety meets privilege.
  • Active Directory (enterprise). The richest terrain: Kerberoasting and AS-REP roasting (crack service-account passwords offline — P05 Chapter 7), unconstrained/constrained delegation abuse, ACL abuse, and DCSync (impersonate a domain controller to pull every password hash). AD privilege escalation is usually graph navigation (BloodHound maps it).
  • Cloud. Permission/trust chaining — iam:PassRole + a compute service to run as a higher role, CreatePolicyVersion to grant yourself anything, or reaching the metadata endpoint for a more privileged role's tokens (P07 Chapter 4 — the IAM attack graph).

The defensive counter. Least privilege everywhere (P05/P07); strong, rotated service-account secrets and managed/group-managed accounts (defeating Kerberoasting); tiered administration so a workstation admin can't reach a domain admin; and attack-path analysis of your own AD/IAM graph (BloodHound, the P07 analyzer) to find and cut the escalation edges before an attacker walks them.

Misconception to kill now. "Each account is least-privilege, so we're safe." Escalation is about composition — a chain of innocuous-looking permissions/edges reaches admin. You must analyze the graph (P07), not the nodes.

Chapter 7: Lateral Movement and Pivoting

Zero background. One foothold is rarely the goal. Lateral Movement (TA0008) is spreading from the compromised host to others to reach the real target (the database, the domain controller, the backup server). The mechanics:

  • Credential reuse / pass-the-hash / pass-the-ticket (T1550). Reuse harvested credentials or Kerberos tickets to authenticate elsewhere without cracking the password (P05 Chapter 7) — the reason a single compromised admin password is catastrophic across a flat network.
  • Remote services (T1021). RDP, SSH, SMB, WinRM, WMI — moving with valid (stolen) credentials over legitimate admin protocols, which looks like normal administration.
  • Pivoting / tunneling. Using the compromised host as a router into networks the attacker can't reach directly (SOCKS proxies, SSH tunnels, port forwarding) — turning one foothold into reach across segments.

The graph view (the key insight, and Lab 02). Lateral movement is reachability over a graph whose nodes are hosts/identities and whose edges are "can authenticate to" / "shares a credential with" / "can reach over the network." An attacker runs a breadth-first search from the foothold to the crown jewels; a defender runs the same search to find the choke points — the host or credential that, if cut, disconnects the foothold from the target. That equivalence is why BloodHound (attack) and attack-path analysis (defense) are the same algorithm.

The defensive counter. Network segmentation (P06/P07/P10) shrinks the graph's edges; least-privilege and unique local-admin passwords (Windows LAPS) break credential-reuse edges; phishing-resistant MFA on internal services and just-in-time admin cut the authentication edges; and detection looks for anomalous east-west movement (a workstation suddenly using WMI/SMB to many hosts — P09).

Misconception to kill now. "The attacker only had one machine." On a flat network with reused admin credentials, one machine is the whole network — lateral movement is fast and quiet. Segmentation and unique credentials are what make the second hop hard.

Chapter 8: Collection, Command-and-Control, and Exfiltration

Collection (TA0009). Gathering the target data — files, databases, email, screenshots, keystrokes — and staging it (compressing/encrypting an archive in a scratch location) before it leaves. Staging is a detection opportunity: large unusual archive creation, mass file reads.

Command-and-Control (TA0011). The channel the foothold uses to receive instructions and return data. Modern C2 (frameworks like Cobalt Strike, Sliver, Mythic — dual-use tools also used by red teams) blends into normal traffic: HTTPS to a legitimate-looking domain, domain fronting, DNS tunneling (P02), or abusing a SaaS API (Slack/Telegram/cloud storage as C2). The defining behavior is beaconing — periodic, regular callbacks — which stands out statistically even when the content is encrypted (P09 — Zeek/network analytics on connection regularity, not payload).

Exfiltration (TA0010). Moving the staged data out — over the C2 channel, to cloud storage, via DNS, or to a physical medium. The signal is volume and destination: a large outbound transfer to a new external endpoint.

The defensive counter. Egress control is the choke point (P06/P07): default-deny outbound, allowlist destinations, and route through a proxy that logs and inspects — this breaks both C2 and exfiltration regardless of the technique. DLP (Data Loss Prevention) and data classification catch sensitive-data movement; network analytics catch beaconing by regularity; and blocking the cloud metadata endpoint (P02/P06) cuts a common credential-theft-to-exfil path.

Misconception to kill now. "The C2 traffic was encrypted, so we couldn't have seen it." You detect C2 by behavior — beacon regularity, rare destinations, JA3/TLS fingerprints, DNS volume — not by reading the payload. Encryption hides content, not pattern.

Chapter 9: Impact — Ransomware, Destruction, and Fraud

Zero background. Impact (TA0040) is the attacker's objective realized. The dominant forms:

  • Ransomware. Modern ransomware is double/triple extortion: the actor exfiltrates data first (Chapter 8), then encrypts (T1486), then threatens to publish — so "we have backups" no longer means "we're fine," because the leak threat remains. Crucially, ransomware is the last step of a long campaign (initial access → escalation → lateral movement → exfil → encrypt); every earlier chapter is an opportunity to have stopped it.
  • Destruction / wipers. Irreversible damage (disk wiping, sabotage) — often nation-state or hacktivist, and the OT analog (P10) is physical impact.
  • Financial fraud / BEC payout. The objective is money moved, not data — a fraudulent wire after a BEC, or cryptocurrency theft.

The defensive counter (and the whole-chain lesson). At the impact stage your options are damage control: immutable, offline, tested backups (so encryption isn't fatal — but they don't solve the leak), segmentation to limit blast radius, rapid isolation (P09), and a tested IR/ransomware playbook with legal/comms. The real lesson: because impact is the end of the chain, defense is cheapest upstream — phishing-resistant MFA (Ch4), least privilege (Ch6), segmentation (Ch7), and egress control (Ch8) prevent the ransomware long before the encryption starts.

Misconception to kill now. "Backups solve ransomware." Backups address the encryption leg, not the data-theft/leak leg of double extortion — and many incidents find the backups were reachable and encrypted too. Prevention upstream and offline, tested backups together are the answer.

Chapter 10: Adversary Emulation and Purple Teaming

Zero background. Knowing the lifecycle lets you test defenses against it, safely and with authorization. The spectrum:

  • Penetration test — find and prove exploitable vulnerabilities in a scoped target.
  • Red team — emulate a specific adversary's TTPs end to end against the live environment to test detection and response, not just "can we get in." Goal-driven and stealthy.
  • Adversary emulation — red-teaming driven by real threat intelligence: pick an actor relevant to your sector, take their documented ATT&CK techniques, and reproduce those (MITRE's emulation plans, Caldera, Atomic Red Team for atomic per-technique tests).
  • Purple team — red and blue working together in a feedback loop: run a technique, check whether detection fired, fix the gap, repeat. This is the fastest way to close coverage gaps (P09).

Scoping and safety (the professional discipline — Phase 00). Every engagement is bounded by authorization: rules of engagement, scope, permitted techniques, stop conditions, deconfliction (so the blue team's real-incident response isn't triggered destructively), and no real destruction, data theft, or persistence left behind. An emulation plan maps each step to an ATT&CK technique and the safe synthetic procedure that exercises it.

The output that matters. Not "we got domain admin" but a per-technique detection-coverage report: for each ATT&CK technique exercised, did prevention block it, did telemetry record it, did a detection alert, and did response act — feeding P09's coverage map and the controls at each choke point. That closing of the loop is the point of running the attack at all.

Misconception to kill now. "Red teaming is about getting in." Getting in is assumed; the value is measuring how fast you're detected and stopped. A red team that breaches silently and a blue team that never noticed both failed — the purpose is to surface and fix that gap.

Lab Walkthrough Guidance

Four labs turn the lifecycle and the three lenses into runnable engines (all synthetic, offline):

  1. Lab 01 — Kill-Chain & ATT&CK Event Mapper. Reconstruct a campaign from scattered events: map each to its kill-chain phase and ATT&CK tactic, order them, and report the earliest stage a control could have broken the chain (Chapters 2, 3–9). The lesson: defend left.
  2. Lab 02 — Network Attack-Path / Pivot Planner. Model hosts/identities and "can-reach"/ "shares-credential" edges as a graph; compute which targets an attacker reaches from a foothold (BFS), and the choke points a defender cuts to disconnect the crown jewels (Chapters 6–7). The lesson: lateral movement is graph reachability.
  3. Lab 03 — Diamond Model Event Correlator. Correlate events that share infrastructure or capability into campaigns, and pivot from one indicator to related events (Chapter 2). The lesson: how threat-intel attribution actually works.
  4. Lab 04 — Weighted Attack-Path Solver. Weight host-graph edges by attacker effort; find the cheapest (least-resistance) path with Dijkstra and the formal dominators — nodes on every path to a target, the true choke points (Chapter 7). The lesson: attackers take the path of least resistance, not fewest hops.
LAB_MODULE=solution pytest -q   # reference (passes)
pytest -q                        # your implementation after the TODOs

Success Criteria

You have internalized this module when you can, without notes:

  1. Walk the attacker lifecycle end to end, naming each stage's goal, common ATT&CK techniques, the telemetry it produces, and the control that breaks the chain there.
  2. Explain the Cyber Kill Chain, Diamond Model, and ATT&CK — what each is for and when to reach for it — and that they compose rather than compete.
  3. Reconstruct a campaign from events and identify the earliest, cheapest disruption point.
  4. Explain lateral movement as graph reachability and find the choke-point host/credential to cut.
  5. Pivot one indicator into a campaign with the Diamond Model.
  6. Distinguish a pen test, red team, adversary emulation, and purple team, and scope a safe, authorized engagement with stop conditions.
  7. Articulate why prevention is cheapest upstream (phishing-resistant MFA, least privilege, segmentation, egress control) and why "no malware found" or "backups exist" are false comforts.

Common Mistakes

  • Defending techniques in isolation instead of finding the campaign's choke points.
  • Treating the three lenses as competitors, or thinking ATT&CK replaced the Kill Chain.
  • Assuming push/SMS MFA is phishing-resistant (it isn't — only WebAuthn/passkeys are).
  • "No malware found = no compromise" (living-off-the-land and valid-accounts intrusions ship none).
  • Believing encrypted C2 is undetectable (beaconing regularity and rare destinations betray it).
  • "Backups solve ransomware" (ignores double-extortion data theft and reachable/encrypted backups).
  • Red-teaming for "did we get in" instead of measuring time-to-detect and time-to-respond.
  • Running any of this outside written authorization, scope, and stop conditions (Phase 00).

Interview Q&A

Q: Walk me through a ransomware intrusion and where you'd break the chain. A: Initial access (phishing or a stolen VPN credential) → execution (a LOLBin loader) → privilege escalation (Kerberoasting or a local-admin reuse) → lateral movement (pass-the-hash over SMB to the file and backup servers) → collection and exfiltration (stage an archive, beacon out over HTTPS) → impact (encrypt + leak threat). I break it upstream and at choke points: phishing-resistant MFA and patching kill most initial access; least privilege and unique local-admin passwords (LAPS) break escalation and the lateral-movement credential edges; segmentation shrinks the graph; egress control stops the C2/exfil; offline tested backups limit the encryption damage. The cheapest defense is furthest left.

Q: Compare the Cyber Kill Chain, Diamond Model, and ATT&CK. A: Different altitudes that compose. The Kill Chain is the linear campaign sequence — it answers "how far along is this and where do we cut it," and its value is detecting left. ATT&CK is the tactic→technique catalog — "what specific behavior is this, and can we detect it" — the shared vocabulary and coverage map. The Diamond Model is the relationship graph (adversary/capability/ infrastructure/victim) — "what else is connected," the basis of pivoting and attribution. I use the Kill Chain to phase an intrusion, ATT&CK to label and detect the techniques, and the Diamond Model to scope the campaign.

Q: How is lateral movement a graph problem, and how does that help the defender? A: Nodes are hosts/identities; edges are "can authenticate to," "shares a credential with," and "can reach over the network." The attacker BFS's from a foothold to the crown jewels; the defender runs the same search to find choke points — the host or credential that, if removed, disconnects the foothold from the target. It's why BloodHound (offense) and attack-path analysis (defense) are one algorithm, and why segmentation, unique local-admin passwords, and tiered admin are the highest-leverage controls.

Q: A red team breached us silently and got domain admin. Did the engagement succeed or fail? A: The test succeeded — it revealed that our detection and response failed. Red-teaming assumes breach; its purpose is to measure time-to-detect and time-to-respond and to surface the coverage gaps. The right next step is a purple-team loop: replay each technique, find why no detection fired, fix it, and re-test — turning the breach into closed detection gaps mapped to ATT&CK.

Q: Why isn't push MFA enough, and what is "phishing-resistant"? A: Push/SMS/TOTP MFA can be phished (a proxy phishing kit relays the code) or fatigued (spam approvals until the user taps "yes"). Phishing-resistant MFA — FIDO2/WebAuthn passkeys — binds the credential to the origin and uses a hardware-held key, so a fake site can't relay it and there's no code to approve. It closes the dominant initial-access channel (stolen/phished credentials).

References

Frameworks and models

  • Lockheed Martin Cyber Kill Chain; Caltagirone, Pendergast & Betz, The Diamond Model of Intrusion Analysis; MITRE ATT&CK (Enterprise/Cloud/ICS) and the ATT&CK Navigator.
  • MITRE D3FEND (defensive techniques) and the Center for Threat-Informed Defense mappings.
  • The Pyramid of Pain (David Bianco) — indicators vs. TTPs (P09).

Adversary emulation and testing

  • MITRE Adversary Emulation Library and Caldera; Red Canary Atomic Red Team.
  • The Unified Kill Chain (Pols) — a longer, looped model unifying Kill Chain + ATT&CK.
  • PTES (Penetration Testing Execution Standard); NIST SP 800-115 (testing); OSSTMM.

Tradecraft references (study defensively; authorized-lab only)

  • BloodHound / attack-path analysis for AD and Azure (the graph view of Chapters 6–7).
  • CISA/FBI joint advisories and DFIR reporting (real campaign walkthroughs mapped to ATT&CK).
  • Phase cross-references: P02 (web/identity/email), P05 (OS/AD escalation), P06/P07 (segmentation, cloud IAM graph, egress), P08 (exploitation/evasion), P09 (detection, IR, pyramid of pain).