4.4. Reflection Checkpoint

Key Takeaways

• Kill Chain breaks attack sequences into stages — Defenders can intervene at any stage; multiple controls at each stage create resilience; identifying which stage an attacker is at shapes the response.
• ATT&CK provides TTP-level granularity — Detection coverage mapping, hunt hypothesis generation, and precise incident documentation all use ATT&CK technique IDs; the Diamond Model provides the attribution and pivoting framework.
• Evidence collection order follows volatility — Collect most volatile evidence first (RAM, running processes) before containment changes system state; hash everything immediately; maintain chain of custody from collection to disposition.
• Containment → Eradication → Recovery is non-negotiable order — Recovery before eradication guarantees reinfection; containment without scoping leaves backdoors untouched.
• Re-imaging is the most reliable eradication — Targeted malware removal may miss persistence mechanisms; re-image when possible, patch and harden before recovery.
• Preparation multiplies response quality — Playbooks, tabletops, and training transform chaotic response into systematic execution; the investment is made before incidents occur.
• Root cause analysis prevents recurrence — Finding and fixing the root cause (not just the symptom) is what separates organizations that improve from those that respond to the same incident repeatedly.

Connecting Forward

Phase 5 shifts from doing incident response to communicating about it. The technical work of vulnerability management and IR only creates value when findings are translated into clear reports, actionable recommendations, and meaningful metrics that drive organizational decisions. Communication is the bridge between security work and security improvement.

Self-Check Questions

1. An attacker gains initial access via a phishing email, establishes C2 via HTTPS, uses stolen credentials to access a file server, and exfiltrates 50GB of data. Map this incident to both the Kill Chain stages and the relevant MITRE ATT&CK tactics. At which stage does detection provide the greatest leverage for limiting damage, and why?

2. During IR, the team discovers the attacker has been present for 6 weeks. They isolate the initial compromised workstation and re-image it. Two days later, the SIEM detects the same C2 traffic from a different endpoint. What IR phase did the team fail to complete properly, and what specific step was skipped?