Lockheed Martin Cyber Kill Chain View

Stage-to-tactic mapping is grounded in a published academic crosswalk (Jiang et al., "CyGATE," arXiv:2508.00478, Appendix F, Table IV) — not this site's own invention — extended for ATT&CK v19's Defense Evasion → Stealth/Defense Impairment split (both inherit Defense Evasion's original "Installation" stage mapping, since they're its direct successor tactics).

Worth knowing before reading this: ATT&CK Enterprise's techniques skew toward the later stages by design — the earlier stages (Reconnaissance, Weaponization, Delivery) are mostly outside Enterprise ATT&CK's own scope, not a gap in this catalog specifically. The Kill Chain's strict linear ordering is also a known simplification — real intrusions often skip or repeat stages, unlike ATT&CK's own no-fixed-path model.