kill-chain-analysis

name	kill-chain-analysis
description	Kill chain analysis and attack path decision-making — findings analysis, attack vector selection, target prioritization, phase transitions.
allowed-tools	Read
metadata	{"subdomain":"orchestration","when_to_use":"analyze findings, select attack vector, prioritize targets, which technique, attack path, next attack, choose approach, alternative vector, blocked what next","tags":"kill-chain, decision-making, attack-path, target-prioritization, technique-selection","mitre_attack":"TA0043, TA0001, TA0002, TA0003, TA0004, TA0005, TA0006, TA0007, TA0008"}

Kill Chain Analysis & Attack Path Decision-Making

Decision Framework

When selecting the next action, evaluate in order:

1. What does the OPPLAN say? — Prioritized objectives drive decisions
2. What do findings tell us? — Previous phase results constrain options
3. What's the risk/reward? — Lower noise approaches first
4. What's the OPSEC impact? — Consult opsec skill before noisy actions

Findings Analysis

After Recon Phase — Selecting Attack Vectors

Read recon/ outputs and categorize:

Finding Type	Indicates	Next Action
Web apps with known CVEs	Web exploitation path	exploit → web techniques
AD services (88/389/636)	AD attack surface	exploit → AD techniques (after initial access)
Exposed credentials (OSINT)	Credential-based access	exploit → credential stuffing/spray
Cloud misconfigs (S3/blob)	Cloud attack path	exploit → cloud-specific techniques
VPN/remote access services	Network perimeter entry	exploit → VPN/RDP exploitation
Employee emails + breach data	Social engineering path	exploit → phishing (if in scope)

Attack Vector Prioritization

Rank available vectors by:

Score = (Success Probability × Impact) / Detection Risk

1. Valid credentials from OSINT        → High prob, High impact, Low noise
2. Known web CVE (public exploit)      → High prob, Med impact, Med noise
3. AD misconfiguration (no patch)      → Med prob,  High impact, Med noise
4. Password spray against O365         → Med prob,  High impact, High noise
5. Zero-day or custom exploit          → Low prob,  High impact, Low noise

Always prefer: credentials > misconfigurations > known CVEs > brute force

After Exploitation — Deciding Post-Exploit Strategy

Once a foothold is established, analyze:

Context	Decision
Low-privilege user on workstation	Prioritize: privesc → cred dump → lateral to server
Service account on server	Prioritize: cred dump (may have cached admin creds) → lateral
Domain user credentials	Prioritize: AD enumeration → Kerberoasting → DCSync path
Local admin on single host	Prioritize: cred dump → check for cached domain creds → lateral
Already domain admin	Prioritize: objective completion → evidence collection → reporting

Handling Blocked Objectives

Failure Analysis Decision Tree

Objective BLOCKED
│
├── WHY did it fail?
│   ├── Defense mechanism (WAF/EDR/IDS)
│   │   → Consult defense-evasion skill → retry with evasion
│   │
│   ├── Missing prerequisite (need creds/access/info)
│   │   → Identify which prior phase provides it → re-order objectives
│   │
│   ├── Target hardened / not vulnerable
│   │   → Check findings for alternative target → redirect attack
│   │
│   └── Tool failure / environment issue
│       → Retry with different tool or approach
│
├── Is there an ALTERNATIVE path?
│   ├── YES → Craft new delegation with adjusted approach
│   └── NO  → Mark BLOCKED, document reason, proceed to next objective
│
└── Should we REVISIT later?
    ├── YES (new intel may help) → Keep status BLOCKED, note in lessons_learned.md
    └── NO (dead end) → Mark BLOCKED permanently

Common Pivots

Original Approach	Alternative When Blocked
SQLi on web app	SSTI, deserialization, SSRF, or move to different web app
Kerberoasting	AS-REP roasting, ADCS abuse, password spray
LSASS dump blocked by EDR	nanodump, comsvcs.dll, MiniDumpWriteDump via syscall
WinRM blocked	PsExec, WMI, DCOM, RDP, SMB exec
Password spray lockout	Low-and-slow spray, single-password-multiple-users

MITRE ATT&CK Phase Mapping

Use this to map OPPLAN objective phases to ATT&CK tactics:

OPPLAN Phase	ATT&CK Tactic	Sub-Agent
Recon	TA0043 Reconnaissance	recon
Initial Access	TA0001 Initial Access	exploit
Execution	TA0002 Execution	exploit
Persistence	TA0003 Persistence	postexploit
Privilege Escalation	TA0004 Privilege Escalation	postexploit
Defense Evasion	TA0005 Defense Evasion	exploit / postexploit
Credential Access	TA0006 Credential Access	postexploit
Discovery	TA0007 Discovery	recon / postexploit
Lateral Movement	TA0008 Lateral Movement	postexploit
Collection	TA0009 Collection	postexploit
Exfiltration	TA0010 Exfiltration	postexploit

Target Prioritization

When multiple targets are available, prioritize:

1. Crown jewels — Targets explicitly named in OPPLAN objectives
2. Domain controllers — Access = domain-wide compromise
3. File servers — Likely contain sensitive data for objectives
4. Admin workstations — Cached credentials for further access
5. Application servers — May contain database credentials, API keys
6. Standard workstations — Lower value, but may provide stepping stones