The Attacker Mindset & Kill Chain

Defenders who only work from compliance checklists tend to lose to attackers who work from goals. An adversary does not care that you patched the server the audit asked about; they care about a path — any path — from where they are to what they want. The attacker mindset is simply the discipline of reasoning about a system the way its designer did not: asking not "does this feature work?" but "what else can this feature be made to do?"

That reframing is the whole game. A password-reset flow is a login bypass waiting to be misused. A file uploader is a way to plant code. A helpful error message is free reconnaissance. None of this requires villainy — it requires curiosity plus a refusal to assume the happy path is the only path.

Crucially, thinking like an attacker is a thinking exercise. You practice it on systems you are authorized to test, in your head, in a lab, or in a bug-bounty scope — never on machines you have no permission to touch. The rest of this module is about the frameworks that turn that mindset into something rigorous and repeatable.

In 2011, analysts at Lockheed Martin published the Cyber Kill Chain, borrowing a military metaphor: a targeted intrusion is a sequence of stages, and breaking any one link breaks the chain. The seven stages are:

1. Reconnaissance — researching the target and its people.
2. Weaponization — pairing an exploit with a deliverable payload.
3. Delivery — getting that payload to the victim (email, web, USB).
4. Exploitation — triggering the code to run.
5. Installation — establishing a foothold that survives reboots.
6. Command & Control (C2) — opening a channel back to the operator.
7. Actions on Objectives — the actual goal: theft, encryption, sabotage.

The model's real value is defensive. Each stage is an opportunity to detect and disrupt, and earlier is cheaper. Blocking a phishing email at Delivery costs you nothing; discovering the adversary at Actions on Objectives means the damage is already done.

The Kill Chain has fair critiques — it is malware- and perimeter-centric, and it undersells insider threats and credential abuse where no "payload" is delivered. That gap is exactly what MITRE ATT&CK fills.

Where the Kill Chain gives you a coarse timeline, MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) gives you a rich, empirically-grounded matrix of how real intrusions actually unfold. First released publicly in 2015, it is now the lingua franca of threat detection.

ATT&CK is organized as tactics (the adversary's goal — the "why") and techniques (the "how"). The Enterprise matrix has 14 tactics, read roughly left to right:

• Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Under each tactic sit dozens of techniques and sub-techniques, each with a stable ID (for example, T1566 is Phishing). Because the taxonomy is shared, a detection engineer, a threat-intel analyst, and a red teamer can all point at the same cell and mean the same thing.

There are companion matrices for Mobile and for Industrial Control Systems (ICS), reflecting that the same adversarial logic applies far beyond office laptops.

All four use overlapping techniques. What separates them is authorization, scope, and intent — and those differences are the entire line between a security professional and a felon.

A red team also differs from a pentest in what it measures: a pentest asks "what is vulnerable?"; a red team asks "would we even notice, and how fast could we respond?" The blue team defends, and when the two work together in a tight feedback loop it is called purple teaming.

Legitimate offensive work begins with paperwork, not payloads. Before a single packet is sent, professionals agree on rules of engagement (RoE): which IP ranges and domains are in scope, which are explicitly off-limits, what times testing may run, which techniques are prohibited (denial-of-service and social engineering are often carved out), and who to call if something breaks or if a real breach is discovered mid-test.

The written authorization — signed by someone who actually owns the systems — is the load-bearing document. Physical red teamers famously carry a "get-out-of-jail letter" naming the client contact, precisely because being caught is a success condition, and they need to prove they were hired.

The law is still being defined. In Van Buren v. United States (2021), the Supreme Court narrowed the CFAA's "exceeds authorized access" clause, ruling that misusing data you are otherwise permitted to access is not automatically a federal crime. That mattered enormously for researchers, but the core prohibition — accessing systems you have no right to — stands firmly. When you find a flaw in the wild, the ethical path is coordinated disclosure: report it privately, give the owner reasonable time to fix it, and never exploit it for gain.