Kill Chain → ATT&CK → D3FEND

The Cyber Kill Chain is a linear model of seven phases an intrusion passes through, created by Lockheed Martin in 2011 to show that an attack is a process you can break at any link. MITRE ATT&CK is a matrix of hundreds of specific techniques observed in real intrusions, grouped under 14 tactics, with no assumed order. The Kill Chain tells you what stage an attack is at; ATT&CK tells you how that stage was actually carried out. They are complementary rather than competing.

Not exactly, though ATT&CK is used far more in day-to-day operations. The Kill Chain survives because it is simple enough to explain to non-specialists and to structure defensive coverage around. ATT&CK is too large for that purpose but far better for detection engineering and threat hunting. Most teams use the Kill Chain for communication and coverage, and ATT&CK for the technical work.

D3FEND is MITRE’s defensive counterpart to ATT&CK. Where ATT&CK catalogues what attackers do, D3FEND catalogues what defenders can do about it, as a knowledge graph of countermeasures mapped to the offensive techniques they address. The practical workflow is to identify an ATT&CK technique, then look up the D3FEND countermeasures that counter it.

They are cutting the problem at different resolutions, and ATT&CK also covers ground the Kill Chain does not. ATT&CK splits activity the Kill Chain compresses, such as separating Discovery, Lateral Movement and Collection where the Kill Chain has only Actions on Objectives. It also added Reconnaissance and Resource Development in 2020 to cover pre-compromise activity. The counts are not meant to line up.

It is perimeter and malware oriented, so it fits an external intrusion better than an insider threat, a stolen credential used at the front door, or a supply chain compromise. Its strict linearity also misrepresents real intrusions, which loop and run steps in parallel. Those gaps are much of the reason ATT&CK was developed and why it is preferred for technical work.