Unified Kill Chain: In → Through → Out (18 phases)

Paul Pols' 2017 meta-framework that synthesizes the Lockheed Cyber Kill Chain and MITRE ATT&CK into 18 phases across three strategic cycles — In (gaining access), Through (network propagation), Out (achieving objectives). The key insight: attacks are campaigns, not chains — phases loop, repeat, and run in parallel, and half the model covers the post-compromise activity the original chain ignored.

The three UKC cycles

in → through → out · non-linear, loops allowed

In — gaining access & establishing a foothold

Phases 1–8: from recon to a working beachhead. Roughly the scope of the original Cyber Kill Chain.

Through — network propagation & positioning

Phases 9–14: where modern intrusions actually live. The post-compromise activity the original chain ignored.

Out — achieving strategic objectives

Phases 15–18: collection, exfiltration, impact, and the strategic "why".

1. Reconnaissance — Gathering information about the target

In — gaining access & establishing a foothold

The attacker harvests information about the target — people, technology, infrastructure, partners. In the UKC this phase also covers internal reconnaissance after a foothold, so it can repeat at any point in the campaign.

Who: Intel + SOC (detection is mostly passive here)
Defender goal: Reduce attack surface and detect targeted scanning that crosses into active recon.
Primary deliverables: Target profile
Exposed-service inventory
Likely access vectors
Common pitfalls: Treating passive OSINT as undetectable — the planning it feeds is not.
Forgetting recon repeats inside the network after initial access.
Framework mapping: Maps to ATT&CK Reconnaissance (TA0043) + Resource Development (TA0042).

Use platform tool: OSINT / recon resources

Walk an incident through the UKC

An 8-step click-through using the Lazarus / Copperhedge sample already in the platform'sAI Report showcaseas the running example — covering all three cycles. Click a step to jump to that phase.

Step 1 of 8 · Reconnaissance · In

Scanning the React/Next.js surface

A partner feed + a CTF IoC report named Lazarus exploiting CVE-2025-55182. The WAF + load balancer logs show the list.txt scanning pattern hitting our Next.js 15.x prod apps.

Artifacts produced at this step

Target profile: 3 prod apps + 1 staging
Access vectors: RSC deserialization RCE

next: Deliver

UKC vs. the other frameworks on the platform

The UKC is a content meta-framework — it describes the campaign at 18-phase granularity. It does not replace ATT&CK (the technique vocabulary) or the process frameworks (F3EAD, F2T2EA, OODA); it feeds them with a complete picture of the adversary's lifecycle.

					Note
Unified Kill Chain	content	What phases did the campaign pass through, across all three cycles?	CTI + DFIR + SOC	/ti/unified-kill-chain	The meta-framework: 18 phases in In / Through / Out cycles, non-linear.
Cyber Kill Chain v2	content	How do multiple intrusions and lateral movement fit the chain?	DFIR + SOC	/ti/kill-chain-v2	The Lockheed extension UKC supersedes — UKC adds the Through cycle and social engineering.
Lockheed Kill Chain	content	What phases did the intrusion pass through?	DFIR + SOC	/d/kill-chain	The original 7-phase chain — the UKC’s In cycle roughly matches its scope.
MITRE ATT&CK	content	Which specific techniques did the adversary use?	Detection eng + CTI	/ti/mitre	The technique vocabulary — each UKC phase maps onto ATT&CK tactics.
F3EAD	process	How does the team operate end-to-end on a target?	CTI + SOC + IR	/ti/f3ead	The workflow the team runs; the UKC describes what the actor did.
F2T2EA	process	How do we locate, track, and act on a target?	Ops + IR (targeting)	/ti/f2t2ea	Joint targeting cycle — the ops side of the same fight.
OODA Loop	process	How fast can we decide and act?	IR + SOC (tempo)	/ti/ooda	Boyd's decision cycle — the tempo at which the team responds to the campaign.
Diamond Model	content	Who did what to whom, and how?	CTI + IR	/d/diamond	Per-event reconstruction that fills in the who behind the campaign.

References

Paul Pols — "The Unified Kill Chain" (2017) — the thesis (TU Delft / University of Twente) that defined the 18-phase model. See also Cyber Kill Chain v2 for the Lockheed-side lineage.
Hutchins, Cloppert, Amin — "Intelligence-Driven Computer Network Defense..." (2011) — the original Cyber Kill Chain the UKC builds on.
MITRE ATT&CK — the technique vocabulary the UKC's phases map onto.
NIST SP 800-61 rev 2 — Computer Security Incident Handling Guide — the IR phases aligned with the Through and Out cycles.
MITRE ATT&CK Blog: "F3EAD: Operationalizing Cyber Threat Intelligence" (2018) — connects campaign-level content to the F3EAD process workflow on this platform.

Unified Kill Chain: In → Through → Out (18 phases)

Note

Unified Kill Chain

content

What phases did the campaign pass through, across all three cycles?

CTI + DFIR + SOC

/ti/unified-kill-chain

The meta-framework: 18 phases in In / Through / Out cycles, non-linear.

Cyber Kill Chain v2

content

How do multiple intrusions and lateral movement fit the chain?

DFIR + SOC

/ti/kill-chain-v2

The Lockheed extension UKC supersedes — UKC adds the Through cycle and social engineering.

Lockheed Kill Chain

content

What phases did the intrusion pass through?

DFIR + SOC

/d/kill-chain

The original 7-phase chain — the UKC’s In cycle roughly matches its scope.

MITRE ATT&CK

content

Which specific techniques did the adversary use?

Detection eng + CTI

/ti/mitre

The technique vocabulary — each UKC phase maps onto ATT&CK tactics.

F3EAD

process

How does the team operate end-to-end on a target?

CTI + SOC + IR

/ti/f3ead

The workflow the team runs; the UKC describes what the actor did.

F2T2EA

process

How do we locate, track, and act on a target?

Ops + IR (targeting)

/ti/f2t2ea

Joint targeting cycle — the ops side of the same fight.

OODA Loop

process

How fast can we decide and act?

IR + SOC (tempo)

/ti/ooda

Boyd's decision cycle — the tempo at which the team responds to the campaign.

Diamond Model

content

Who did what to whom, and how?

CTI + IR

/d/diamond

Per-event reconstruction that fills in the who behind the campaign.

Unified Kill Chain: In → Through → Out (18 phases)

In — gaining access & establishing a foothold

Reconnaissance

Weaponization

Social Engineering

Delivery

Exploitation

Persistence

Defense Evasion

Command & Control

Through — network propagation & positioning

Pivoting

Discovery

Privilege Escalation

Execution

Credential Access

Lateral Movement

Out — achieving strategic objectives

Collection

Exfiltration

Impact

Objectives

1. Reconnaissance — Gathering information about the target

Scanning the React/Next.js surface

Unified Kill Chain: In → Through → Out (18 phases)

In — gaining access & establishing a foothold

Reconnaissance

Weaponization

Social Engineering

Delivery

Exploitation

Persistence

Defense Evasion

Command & Control

Through — network propagation & positioning

Pivoting

Discovery

Privilege Escalation

Execution

Credential Access

Lateral Movement

Out — achieving strategic objectives

Collection

Exfiltration

Impact

Objectives

1. Reconnaissance — Gathering information about the target

Scanning the React/Next.js surface