Analyzing Cyber Kill Chain

Maps incident forensics to Lockheed Martin's 7-phase kill chain so you can see exactly where an attack succeeded, where it stalled, and what controls would've stopped it earlier. Most useful during post-mortems when you need to explain attack progression to non-technical stakeholders or identify detection gaps in your defenses. The workflow walks you through phase-by-phase mapping (recon through actions on objectives), cross-references MITRE ATT&CK techniques for granularity, and outputs actionable COAs per phase. One honest warning: the linear model breaks down with insider threats and sophisticated adversaries who skip or loop back through phases, so don't treat it as gospel for every scenario.

skills.sh installs: 614
GitHub stars: 35.9K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-cyber-kill-chain --agent claude-code

Installs into .claude/skills of the current project.

Files

Analyzing Cyber Kill Chain

When to Use

Use this skill when:

Conducting post-incident analysis to determine how far an adversary progressed through an attack sequence
Designing layered defensive controls with the goal of interrupting attacks at the earliest possible phase
Producing threat intelligence reports that communicate attack progression to non-technical stakeholders

Do not use this skill as a standalone framework — combine with MITRE ATT&CK for technique-level granularity beyond what the 7-phase kill chain provides.

Prerequisites

Complete incident timeline with forensic artifacts mapped to specific adversary actions
MITRE ATT&CK Enterprise matrix for technique-level mapping within each kill chain phase
Access to threat intelligence on the suspected adversary group's typical kill chain progression
Post-incident report or IR timeline from responding team