Unified Kill Chain — a free Threat Intel tool on pranithjain.qzz.io. Browser-side security analysis, no signup required.
This is a free, browser-based threat intelligence platform on pranithjain.qzz.io. No signup required — all processing runs locally in your browser.
Paul Pols' 2017 meta-framework that synthesizes the Lockheed Cyber Kill Chain and MITRE ATT&CK into 18 phases across three strategic cycles — In (gaining access), Through (network propagation), Out (achieving objectives). The key insight: attacks are campaigns, not chains — phases loop, repeat, and run in parallel, and half the model covers the post-compromise activity the original chain ignored.
Phases 1–8: from recon to a working beachhead. Roughly the scope of the original Cyber Kill Chain.
Phases 9–14: where modern intrusions actually live. The post-compromise activity the original chain ignored.
Phases 15–18: collection, exfiltration, impact, and the strategic "why".
In — gaining access & establishing a foothold
The attacker harvests information about the target — people, technology, infrastructure, partners. In the UKC this phase also covers internal reconnaissance after a foothold, so it can repeat at any point in the campaign.
An 8-step click-through using the Lazarus / Copperhedge sample already in the platform'sAI Report showcaseas the running example — covering all three cycles. Click a step to jump to that phase.
Step 1 of 8 · Reconnaissance · In
A partner feed + a CTF IoC report named Lazarus exploiting CVE-2025-55182. The WAF + load balancer logs show the list.txt scanning pattern hitting our Next.js 15.x prod apps.
Artifacts produced at this step
next: Deliver
The UKC is a content meta-framework — it describes the campaign at 18-phase granularity. It does not replace ATT&CK (the technique vocabulary) or the process frameworks (F3EAD, F2T2EA, OODA); it feeds them with a complete picture of the adversary's lifecycle.
| Note | |||||
|---|---|---|---|---|---|
| Unified Kill Chain | content | What phases did the campaign pass through, across all three cycles? | CTI + DFIR + SOC | /ti/unified-kill-chain | The meta-framework: 18 phases in In / Through / Out cycles, non-linear. |
| Cyber Kill Chain v2 | content | How do multiple intrusions and lateral movement fit the chain? | DFIR + SOC | /ti/kill-chain-v2 | The Lockheed extension UKC supersedes — UKC adds the Through cycle and social engineering. |
| Lockheed Kill Chain | content | What phases did the intrusion pass through? | DFIR + SOC | /d/kill-chain | The original 7-phase chain — the UKC’s In cycle roughly matches its scope. |
| MITRE ATT&CK | content | Which specific techniques did the adversary use? | Detection eng + CTI | /ti/mitre | The technique vocabulary — each UKC phase maps onto ATT&CK tactics. |
| F3EAD | process | How does the team operate end-to-end on a target? | CTI + SOC + IR | /ti/f3ead | The workflow the team runs; the UKC describes what the actor did. |
| F2T2EA | process | How do we locate, track, and act on a target? | Ops + IR (targeting) | /ti/f2t2ea | Joint targeting cycle — the ops side of the same fight. |
| OODA Loop | process | How fast can we decide and act? | IR + SOC (tempo) | /ti/ooda | Boyd's decision cycle — the tempo at which the team responds to the campaign. |
| Diamond Model | content | Who did what to whom, and how? | CTI + IR | /d/diamond | Per-event reconstruction that fills in the who behind the campaign. |