Kill Chain / Attack Path Analysis

Description

Decomposition of an attack into its sequential phases, from initial reconnaissance through final effect on the target. Originated in military targeting doctrine (“kill chain”) and adapted for cybersecurity by Lockheed Martin’s Cyber Kill Chain framework (Hutchins, Cloppert, Amin, 2011). The core insight is that every attack follows a structured progression, and disrupting any single phase can defeat the entire attack. In the space domain, kill chain analysis applies to counterspace operations (kinetic ASAT, electronic warfare, cyber intrusions against satellite systems), hybrid attacks combining multiple domains, and defensive planning to identify where to break an adversary’s attack sequence.

When to Use

Analyzing specific counterspace attack scenarios (ASAT engagement, satellite cyber compromise, ground station attack).
Evaluating defensive architectures by identifying optimal disruption points in an adversary’s attack sequence.
Topics with a strong cyber or military operational focus.
Understanding how electronic warfare, cyber operations, and kinetic effects chain together in anti-satellite operations.
When the analysis needs to show the step-by-step mechanics of how a specific threat materializes.
Supporting development of defensive countermeasures at each phase of an attack.

How to Apply

Define the attack scenario. Specify the adversary, the target (satellite, ground station, data link, supply chain), the intended effect (denial, degradation, destruction, exploitation), and the operational context (peacetime, crisis, conflict).
Map the kill chain phases. Decompose the attack into sequential stages. Use the classic seven-phase model adapted for the space domain:
- Reconnaissance: Intelligence gathering on target orbital parameters, frequencies, ground station locations, software versions, supply chain vendors.
- Weaponization: Development or adaptation of the attack capability (ASAT missile, malware payload, jamming equipment, co-orbital inspector/weapon).
- Delivery: Positioning the weapon or exploit for employment (launch of interceptor, injection of malware into update pipeline, deployment of jammer).
- Exploitation: Engaging the vulnerability (proximity approach, RF link intrusion, software exploitation, physical impact).
- Installation: Establishing persistent access or effect (implanting backdoor, positioning co-orbital asset, degrading orbit).
- Command & Control: Maintaining control over the attack (C2 links to co-orbital weapon, managing cyber implant, coordinating multi-domain effects).
- Action on Objective: Achieving the intended effect (satellite destruction, data exfiltration, service denial, political signaling).
Identify requirements at each phase. For every phase, document what the attacker needs: intelligence, technology, access, timing, coordination, deniability. Assess which requirements are easy vs. difficult to fulfill.
Assess detection opportunities. At each phase, identify what observables the attack generates and whether defenders can detect them: space surveillance tracking, RF monitoring, cyber intrusion detection, intelligence indicators.
Identify disruption points. For each phase, determine what defensive actions could break the chain: hardening (reducing vulnerabilities), detection (raising the alarm), denial (preventing attacker access), deception (feeding false information), deterrence (raising costs).
Evaluate chain robustness. Assess how resilient the attack chain is: does the adversary have redundant paths? Can they bypass disrupted phases? How adaptive is the attacker? Identify the weakest and strongest links.
Recommend defensive priorities. Based on the analysis, recommend where defensive investment yields the highest return — prioritizing disruption at the earliest feasible phase (left of launch/exploit) and building defense-in-depth across multiple phases.

Key Dimensions

Phase sequencing — The ordered progression from reconnaissance to effect, including dependencies between phases.
Attacker requirements — Resources, intelligence, access, and capabilities needed at each phase.
Time dynamics — Duration of each phase, total attack timeline, time-critical windows.
Observables and signatures — What the attack generates that could be detected at each phase.
Disruption leverage — Which phases offer the greatest defensive advantage if interrupted.
Redundancy and adaptation — Whether the attacker has alternative paths or can recover from disrupted phases.
Cross-domain integration — How the attack spans physical, cyber, electronic, and information domains.
Attribution difficulty — How hard it is to identify the attacker at each phase, especially relevant for gray-zone operations.

Expected Output

A phase-by-phase kill chain diagram or table for the specific attack scenario.
For each phase: attacker actions, requirements, observables, and defensive options.
Identification of the most vulnerable phase(s) from the defender’s perspective (best disruption opportunities).
Assessment of attack chain robustness and attacker adaptation options.
Prioritized defensive recommendations with phase-specific countermeasures.
Timeline estimate for the full attack sequence.

Limitations

Most useful for well-defined, sequential attack scenarios; less applicable to diffuse, systemic, or slow-onset threats (regulatory erosion, market manipulation, norm degradation).
The linear phase model can oversimplify complex, iterative, or parallel attack patterns — real adversaries may operate multiple kill chains simultaneously or cycle through phases non-sequentially.
Requires substantial technical knowledge of both the attack capability and the target system; superficial application yields superficial results.
Defender-centric bias: the framework assumes the defender can observe and act at each phase, which may not reflect reality (especially in space where situational awareness is limited).
Less relevant for policy-level analysis than for operational or technical assessment — should be embedded within broader strategic frameworks rather than used standalone.
The classic Lockheed Martin model was designed for network intrusions; space domain adaptation requires careful modification to account for physical, RF, and orbital mechanics dimensions.