OpenCyber AcademyLesson map
Lesson 31 published. Map, example, EX091.
flowchart TD
N0["Learning outcomes"]
N1["31.1 From events to phases"]
N2["Lab — ordering phases"]
N3["31.2 Reading the result"]
N4["31.3 A labelling caution"]
N5["31.4 Tempo"]
N6["31.5 Opportunities"]
N7["31.6 Presenting timelines"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX091"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["31.1 From events to phases"]
N2["Lab — ordering phases"]
N3["31.2 Reading the result"]
N4["31.3 A labelling caution"]
N5["31.4 Tempo"]
N6["31.5 Opportunities"]
N7["31.6 Presenting timelines"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX091"]
[Learning outcomes]
|
v
[31.1 From events to phases]
|
v
[Lab — ordering phases]
|
v
[31.2 Reading the result]
|
v
[31.3 A labelling caution]
|
v
[31.4 Tempo]
|
v
[31.5 Opportunities]
|
v
[31.6 Presenting timelines]
|
v
[Worked example] --> [Exercise EX091]
Learning outcomes
You will (1) reconstruct an intrusion timeline across kill-chain phases; (2) distinguish preparation from intrusion phases; (3) identify defensive opportunities at each phase; (4) present a timeline clearly.
31.1 From events to phases
Hutchins et al. defined phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Placing timestamped events into phases shows the intrusion's tempo and where defenders could have acted.
Amara uses the phases as columns in a simple table, with each event placed in one phase and its evidence source noted beside it. Phases with no events are left visible rather than removed, since an empty phase may mean the attacker skipped it or that HCHT has no logs that would show it.
Lab — ordering phases
"""Lab 7 (ch 31): order synthetic incident events by time and label kill-chain phases."""
events = [
("2026-09-03 10:02", "beacon to files.example over HTTPS", "command and control"),
("2026-09-03 09:41", "user opens invoice attachment", "exploitation"),
("2026-09-03 09:30", "phishing email delivered", "delivery"),
("2026-09-02 18:00", "lookalike domain registered", "weaponization"),
("2026-09-03 09:45", "scheduled task created", "installation"),
]
for t, what, phase in sorted(events):
print(t, f"{phase:20}", what)
first, last = min(events)[0], max(events)[0]
print("span:", first, "->", last)
Run with python3 lab_phases.py. Verified output:
2026-09-02 18:00 weaponization lookalike domain registered
2026-09-03 09:30 delivery phishing email delivered
2026-09-03 09:41 exploitation user opens invoice attachment
2026-09-03 09:45 installation scheduled task created
2026-09-03 10:02 command and control beacon to files.example over HTTPS
span: 2026-09-02 18:00 -> 2026-09-03 10:02
31.2 Reading the result
The script orders five synthetic events: weaponization at 2026-09-02 18:00, delivery at 09:30 the next day, exploitation at 09:41, installation at 09:45 and command and control at 10:02. The span is 2026-09-02 18:00 to 2026-09-03 10:02.
Amara checks each timestamp against its source log and confirms that all five are in UTC before ordering them. Ordering is simple, but a single event in local time would have placed command and control before exploitation, which makes no sense and would mislead anyone reading the timeline. She also records which log provided each event.
31.3 A labelling caution
The "weaponization" event is actually the registration of a lookalike domain. ATT&CK classifies that as resource development — Acquire Infrastructure (T1583) — which happens before the intrusion. The kill chain's weaponization phase strictly means pairing an exploit with a deliverable payload. Analysts should say which framework's terms they use; here the event is better called preparation.
Amara adds a note to the table explaining the choice of terms. Using the precise term keeps the timeline accurate for readers who know either framework, and it avoids implying that the attacker had built a payload by that point.
31.4 Tempo
From delivery to command and control took 32 minutes. That window tells HCHT that alerting on the first phases must reach a human within minutes, not the next day.
Amara checks how long HCHT's current alerts take to reach a person and finds that some email alerts are reviewed only the next morning. The tempo of this intrusion shows that delay would let an attacker reach command and control long before anyone looked. The team moves high-priority email and endpoint alerts to the on-call phone during working hours and reviews the rule after a month.
31.5 Opportunities
Domain monitoring could flag registration; email filtering could block delivery; endpoint controls could stop installation; DNS monitoring could catch command traffic.
Amara compares each opportunity with HCHT's existing controls and finds that only email filtering is in place for this type of attack. Domain monitoring is the subject of her capstone; DNS monitoring needs a decision from the network team. She ranks the opportunities by cost and by how early they act, since stopping an intrusion at delivery is far cheaper than responding after installation. The ranking goes to the security lead.
31.6 Presenting timelines
A good timeline figure uses one time zone, labels each event with its evidence source, and marks gaps where nothing is known. Readers then see not only what happened but where the record is thin, which guides the next questions.
Amara's figure for the synthetic incident marks the gap before delivery. Nothing is recorded between the domain registration and the phishing email, about fifteen hours, so the figure shows that period as unknown rather than quiet. Each event label names its log source, and the caption states the time zone. Readers asked whether HCHT could have seen earlier activity, which is the question the gap is meant to raise.
Worked example
Amara presents the timeline to the incident lead, marking each phase with the control that could have acted. The lead picks two: lookalike-domain monitoring through certificate transparency and faster alert routing for endpoint installation events.
Synthetic case. The intrusion is invented.
Errors and limits
Real intrusions loop and skip phases; a linear timeline is a simplification.
Exercises
- EX091 — Tempo. How long from delivery to command and control in the lab, and what does it imply?
Show marking criteria
Rubric: 3 = 32 minutes; alerts must reach humans within minutes; 2 = number only; 1 = wrong; 0 = none. - EX092 — Mislabel. Why is domain registration better labelled preparation than weaponization?
Show marking criteria
Rubric: 3 = it is resource development/T1583; weaponization = pairing exploit and payload; 2 = partial; 1 = no difference; 0 = none. - EX093 — Phase control. Name a control for the delivery phase in this case.
Show marking criteria
Rubric: 3 = email filtering of lookalike sender/attachments, with link to phase; 2 = name; 1 = backup; 0 = none.
Synthesis
Order events into phases, name terms precisely, read the tempo and pick controls per phase.
Continue studying — chapter 31 of 40
← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →