Extended Cyber Kill Chain for AI-Era Threats

Notifications You must be signed in to change notification settings

Fork 1

Star 2

BranchesTags

Open more actions menu

Folders and files

NameName

Last commit message

Last commit date

Latest commit

History

4 Commits

4 Commits

ai-kill-chain

ai-kill-chain

.gitattributes

.gitattributes

.zenodo.json

.zenodo.json

CITATION.cff

CITATION.cff

LICENSE

LICENSE

PUBLISH.md

PUBLISH.md

README.md

README.md

extended-kill-chain.svg

extended-kill-chain.svg

Repository files navigation

An update to the Lockheed Martin Cyber Kill Chain for defenders working against LLM and agentic AI attacks. Adds a pre-attack stage for model supply chain compromise. Adds AI-specific sub-techniques to each of the original seven stages. Splits the Actions on Objectives stage into three peer sub-stages: classical data exfiltration, model extraction, and agentic pivot.

Author: Gourav Nagar Version: 1.0 Date: May 19, 2026 Repository: https://github.com/gouravnagar-infosec/ai-kill-chain

Cite as: Nagar, G. (2026). Extended Cyber Kill Chain for AI-Era Threats (Version 1.0). https://github.com/gouravnagar-infosec/ai-kill-chain

Table of contents

Abstract

Background

Why the seven-stage model is not enough

The framework at a glance

Stage-by-stage specification

Stage 0. Model Supply Chain Compromise (new)

Stage 1. Reconnaissance (AI-augmented)

Stage 2. Weaponization (AI-augmented)

Stage 3. Delivery (AI-augmented)

Stage 4. Exploitation (AI-augmented)

Stage 5. Installation (AI-augmented)

Stage 6. Command and Control (AI-augmented)

Stage 7. Actions on Objectives (expanded)

Relationship to MITRE ATLAS, OWASP LLM Top 10, NIST AI RMF

Worked case studies

Detection and mitigation guidance

Originality statement

How to cite

References

License

Abstract

The Lockheed Martin Cyber Kill Chain has been the working model for how defenders describe an intrusion campaign since 2011. Seven stages from reconnaissance to actions on objectives. Network and endpoint attack surface. Human attackers operating tools against deterministic targets. Its value to defenders is the disruption logic: block any one stage and the rest of the chain cannot complete.

LLMs and AI agents do not fit that picture. Attackers now target model weights, training data, system prompts, tool descriptions. A document or a web page can carry instructions that an AI agent will execute as if a user had typed them. Agents with tool access can pivot through legitimate trust relationships without ever loading shellcode.

MITRE ATLAS and the OWASP LLM Top 10 both catalog these threats. ATLAS v5.4.0 (February 2026) has 16 tactics, 84 techniques, and 42 case studies, with coverage that reaches into indirect prompt injection and agentic command and control. OWASP's 2025 LLM Top 10 prioritizes ten risk categories for application builders. Both are organized as matrices or risk lists. Neither is a kill chain.

This document is the kill-chain-shaped view of the same content. It is written for SOC analysts and detection engineers who already think in kill chain stages.

It does three things on top of the canonical seven. It adds a new pre-attack stage (Stage 0) for adversary activity against the AI supply chain itself. It adds AI-specific sub-techniques inside each of the original seven stages, with EKC IDs so detection rules and SOC playbooks can reference them. And it splits Stage 7 (Actions on Objectives) into three peer sub-stages: classical data exfiltration, model extraction, and agentic pivot.

This is not a replacement for ATLAS or OWASP. It is the kill-chain-shaped view of the same threat surface.

Background

The original Cyber Kill Chain, from Hutchins, Cloppert, and Amin's 2011 Lockheed Martin paper, breaks an intrusion into seven stages.

Stage Name What the adversary is doing

1 Reconnaissance Picking targets

2 Weaponization Pairing an exploit with a payload

3 Delivery Getting the weapon to the target

4 Exploitation Triggering it

5 Installation Implanting persistence

6 Command and Control Establishing a control channel

7 Actions on Objectives Achieving the mission

The model is the basis of more than a decade of detection engineering practice, threat intel reporting structure, and SOC playbook design. A book-length treatment of the framework and its operational use is Nagar and Kumar (2025), Cyber Security Kill Chain: Tactics and Strategies (Packt). This framework extends that book.

Why the seven-stage model is not enough

The original assumptions break in four places for AI-era attacks.

Attacks now have a pre-network stage. A poisoned dataset or a compromised pre-trained model sitting on a public registry can compromise a target organization before any packet crosses a firewall. The canonical kill chain starts at Reconnaissance and has nowhere to put this.

Prompts mix code and data. LLMs cannot reliably tell instructions apart from content. Hidden text in a web page, an email, or a tool description can become instructions the model follows. What the kill chain treats as separate Delivery and Exploitation stages collapses into a single primitive in the AI case: indirect prompt injection.

Models themselves are targets now. Adversaries want the weights, the fine-tuning data, the system prompts, the capabilities encoded in deployed models. "Data exfiltration" understates this. Model extraction, training-data extraction, capability mining each have different mechanics and need different defenses.

And agents pivot through their own permissions. A compromised AI agent with tool access (MCP, function calling, browser control) does not need to escalate privileges or load shellcode. It invokes the tools it is already allowed to use. The mechanics are not classical lateral movement, but the effect on a target environment is.

ATLAS has been catching up. v4.9.0 (April 2025) added Command and Control as a tactic (AML.TA0014). v5.1.0 (November 2025) added Lateral Movement (AML.TA0015). As of v5.4.0 (February 2026) ATLAS is a 16-tactic matrix with good coverage of agentic threats, including case studies for SesameOp (AML.CS0042) and OpenClaw (AML.CS0050, AML.CS0051). This framework does not exist to fill gaps in ATLAS; ATLAS works as a matrix. It exists because the same content needs to be available to defenders who reason in kill-chain stages, with the original stage disruption logic still doing the work.

The framework at a glance

flowchart LR S0["Stage 0 Model Supply Chain Compromise NEW"]:::new S1["Stage 1 Reconnaissance AI-augmented"]:::mod S2["Stage 2 Weaponization AI-augmented"]:::mod S3["Stage 3 Delivery AI-augmented"]:::mod S4["Stage 4 Exploitation AI-augmented"]:::mod S5["Stage 5 Installation AI-augmented"]:::mod S6["Stage 6 Command & Control AI-augmented"]:::mod S7["Stage 7 Actions on Objectives EXPANDED"]:::expanded S7A["7a. Data Exfiltration classical"]:::expanded S7B["7b. Model Extraction NEW"]:::new S7C["7c. Agentic Pivot NEW"]:::new

S0 --> S1 --> S2 --> S3 --> S4 --> S5 --> S6 --> S7 S7 --> S7A S7 --> S7B S7 --> S7C

classDef new fill:#ffe6e6,stroke:#cc0000,stroke-width:2px,color:#000 classDef mod fill:#fff4d6,stroke:#cc8800,stroke-width:2px,color:#000 classDef expanded fill:#e6f0ff,stroke:#0044cc,stroke-width:2px,color:#000

Loading

Red is new, yellow is original with AI sub-techniques, blue is original but structurally expanded.

The framework adds three things to the seven-stage original. A new pre-attack Stage 0 sits in front of Reconnaissance to cover adversary activity against the AI supply chain. Each original stage picks up its own AI-specific sub-techniques with EKC IDs, so detection rules and threat reports can reference them. Stage 7 splits into three peer sub-stages: classical exfiltration stays in place as 7a, with Model Extraction (7b) and Agentic Pivot (7c) added next to it. These are not variants of exfiltration. They are distinct adversary objectives that need their own controls.

Stage-by-stage specification

Each stage spec below covers four things. What the adversary is doing. The AI-specific sub-techniques (with EKC IDs that can be cited in detection rules and threat reports). The detection signals a defender can act on. The mitigations.

Stage 0. Model Supply Chain Compromise (new)

What the adversary is doing. Compromising a model, dataset, fine-tuning adapter, or distribution channel that the target organization will pull into its own AI systems later. The adversary never touches the target's network. They put the compromise into the supply chain and wait.

Sub-techniques.

ID Sub-technique Description

EKC-0.1 Training data poisoning Inject manipulated examples into a public dataset, web-scraped corpus, or labeling pipeline that future training runs will ingest.

EKC-0.2 Fine-tuning backdoor Distribute a fine-tuning adapter, LoRA, or full-model checkpoint with a hidden trigger-and-behavior pair.

EKC-0.3 Pre-trained model trojan Publish a malicious model to a public registry (Hugging Face, Ollama Library, GitHub) under a plausible name or by typosquatting a real one.

EKC-0.4 Tokenizer or preprocessing manipulation Alter tokenization, normalization, or feature-extraction code in an upstream dependency to add a covert input channel.

EKC-0.5 Malicious MCP server or tool catalog entry Publish a tool description, MCP server manifest, or function definition designed to be invoked by downstream agents and exploit them through prompt injection in the tool description itself.

Detection signals.

Provenance gaps in deployed model artifacts (no signed manifest, no known training-data lineage).

Cryptographic hash drift between a model pulled from a registry today and the same identifier pulled at a prior date.

Tool descriptions from third-party MCP servers that contain unusually long, instruction-like text or non-printable characters.

Anomalous neuron-activation distributions in a deployed model when probed with a curated trigger suite.

Primary mitigations.

Keep a model bill of materials (M-BOM) for every deployed model, including base model identity, fine-tuning data hashes, and adapter provenance.

Sign and verify model artifacts. Pin specific commit hashes for registry-hosted models.

Quarantine and sandbox newly added MCP servers. Review tool descriptions as untrusted input.

Routine backdoor-trigger scanning against deployed models using published benchmarks.

Stage 1. Reconnaissance (AI-augmented)

What the adversary is doing. Finding the target's AI systems, what they can do, what their guardrails are, and what they connect to.

AI-augmented sub-techniques.

ID Sub-technique Description

EKC-1.1 Model fingerprinting Identify the base model, fine-tune family, and version of a deployed LLM through response-style probing, latency analysis, or known-answer tests.

EKC-1.2 System prompt enumeration Use leakage queries, role-play probes, or boundary-case prompts to recover the system prompt or its main constraints.

EKC-1.3 Capability and tool enumeration Discover which tools, plugins, MCP servers, or function-call interfaces the agent has access to.

EKC-1.4 Guardrail mapping Map the policy boundary by probing refusal patterns and finding topics, formats, or input shapes that bypass classifiers.

EKC-1.5 Embedding and retrieval surface discovery Identify which retrieval sources the system reads from (vector store contents, document corpora, web fetch domains).

Detection signals. High-entropy prompt sessions from a single source. Systematic exploration of refusal boundaries. Queries that closely match published jailbreak corpora. Repeated requests for the system to "repeat the instructions above."

Primary mitigations. Rate-limit and behavior-cluster prompt traffic per user identity. Redact identifying response artifacts. Add canary tokens to the system prompt that fire on exfiltration. Restrict tool enumeration to authenticated, audited callers.

Stage 2. Weaponization (AI-augmented)

What the a

[truncated for AI cost control]