Offensive Lab 01 — Kill-Chain & ATT&CK Event Mapper

Lenses: Cyber Kill Chain + MITRE ATT&CK. WARMUP: Chapters 2–9.

The problem

An intrusion arrives as scattered, out-of-order events — an alert here, a log line there. To respond you must turn them into a campaign: which ATT&CK technique is each, where in the lifecycle does it sit, how far did the attacker get, and — most important — where was the earliest, cheapest place to break the chain? "Defend left": the lower the tactic in the lifecycle, the more downstream damage a control there prevents.

What you build (lab.py)

  • classify(technique_id) — {technique, name, tactic, order, break_control} (the break-the-chain control for each technique).
  • reconstruct(events) — order scattered events along the lifecycle (tactic order → timestamp → id).
  • tactics_reached(events) / furthest_tactic(events) — "how far along is this intrusion?"
  • earliest_break(events) — the lowest-order event and the control that would have broken the chain there.

Attack cases the tests cover

  • A ransomware campaign (phishing → execution → lateral movement → exfiltration → impact) observed out of order is reconstructed into lifecycle order.
  • furthest_tactic reports the deepest stage reached.
  • earliest_break returns the lowest-order tactic (and prefers reconnaissance when present) with its defensive control.
  • Unknown techniques and empty inputs are handled; output is deterministic.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Load the real ATT&CK STIX bundle (full technique→tactic mapping, sub-techniques).
  • Map each technique to its detection data sources and join with a coverage map (P09).
  • Score the campaign's dwell time (first-to-last event) and flag the longest undetected gap.
  • Emit an ATT&CK Navigator layer of the observed techniques.

Interview / resume

"Built a campaign reconstructor that maps scattered events to ATT&CK techniques/tactics, orders them along the attacker lifecycle, reports how far an intrusion progressed, and identifies the earliest break point — encoding the 'defend left' principle."

Limitations: a representative technique slice (not the full ATT&CK matrix); single-tactic per technique; lifecycle order approximated by ATT&CK enterprise tactic order.