Kill Chain Analysis & Attack Path Decision-Making

Decision Framework

When selecting the next action, evaluate in order:

1. What does the OPPLAN say? — Prioritized objectives drive decisions
2. What do findings tell us? — Previous phase results constrain options
3. What's the risk/reward? — Lower noise approaches first
4. What's the OPSEC impact? — Consult opsec skill before noisy actions

Findings Analysis

After Recon Phase — Selecting Attack Vectors

Read recon/ outputs and categorize:

Attack Vector Prioritization

Rank available vectors by:

Score = (Success Probability × Impact) / Detection Risk

1. Valid credentials from OSINT        → High prob, High impact, Low noise
2. Known web CVE (public exploit)      → High prob, Med impact, Med noise
3. AD misconfiguration (no patch)      → Med prob,  High impact, Med noise
4. Password spray against O365         → Med prob,  High impact, High noise
5. Zero-day or custom exploit          → Low prob,  High impact, Low noise

Always prefer: credentials > misconfigurations > known CVEs > brute force

After Exploitation — Deciding Post-Exploit Strategy

Once a foothold is established, analyze:

Handling Blocked Objectives

Failure Analysis Decision Tree

Objective BLOCKED
│
├── WHY did it fail?
│   ├── Defense mechanism (WAF/EDR/IDS)
│   │   → Consult defense-evasion skill → retry with evasion
│   │
│   ├── Missing prerequisite (need creds/access/info)
│   │   → Identify which prior phase provides it → re-order objectives
│   │
│   ├── Target hardened / not vulnerable
│   │   → Check findings for alternative target → redirect attack
│   │
│   └── Tool failure / environment issue
│       → Retry with different tool or approach
│
├── Is there an ALTERNATIVE path?
│   ├── YES → Craft new delegation with adjusted approach
│   └── NO  → Mark BLOCKED, document reason, proceed to next objective
│
└── Should we REVISIT later?
    ├── YES (new intel may help) → Keep status BLOCKED, note in lessons_learned.md
    └── NO (dead end) → Mark BLOCKED permanently

Common Pivots

MITRE ATT&CK Phase Mapping

Use this to map OPPLAN objective phases to ATT&CK tactics:

Target Prioritization

When multiple targets are available, prioritize:

1. Crown jewels — Targets explicitly named in OPPLAN objectives
2. Domain controllers — Access = domain-wide compromise
3. File servers — Likely contain sensitive data for objectives
4. Admin workstations — Cached credentials for further access
5. Application servers — May contain database credentials, API keys
6. Standard workstations — Lower value, but may provide stepping stones