Controls Mapping — Kill Chain vs Controls

Purpose: Map each stage of an attack kill chain to the specific Cirius Group controls that prevent, detect, or respond to activity at that stage. Identify the coverage gaps per stage so investment decisions are driven by where detection is weakest, not by where it is easiest to add.

Owner: Rory (Security Officer) Audience: Security Officer, engineering, incident responders, auditors Review frequency: Annual in December, plus when a new control is added or an existing one changes state Last reviewed: April 2026

---

Kill chain stages used

We follow the eight-stage model also used in CLAUDE.md and runbooks/kill-chain-audit-policy.md for consistency with the kill-chain detection workstream:

1. Initial Access
2. Execution
3. Persistence
4. Credential Access / Dumping
5. Lateral Movement
6. Exfiltration
7. Defense Evasion
8. Impact (Encryption / Destruction)

Each stage below lists preventive and detective controls, followed by the gap.

---

Stage 1 — Initial Access

Attacker goal: Get a foothold in the environment (credential compromise, exploit, phishing payload, exposed service).

Preventive controls:

• Entra Conditional Access (block legacy auth, require MFA, device compliance)
• Twingate ZTA — primary remote access, no inbound RDP/VPN from internet
• Palo Alto firewall perimeter (4 VM-Series + Panorama)
• No publicly-exposed management surfaces (Panorama, ACTDIR, psql-secops-prod all private)
• KnowBe4 phishing simulation + annual training
• Patch management cadence (security/patch-management.md)

Detective controls:

• SecOps identity agent (credential spray, impossible travel, first-sign-in-from-unmanaged-device)
• Palo Alto threat prevention + DNS Security
• Maester M365 audit (CA posture validation weekly)
• Cortex XDR for client-side exploit detection
• Arctic Wolf MDR
• Twingate_CL logs in LAW

Gap: FIDO2 not yet deployed for privileged accounts (see compliance/risk-acceptance-register.md RA-2026-001). AiTM-phishing-resistant auth pending.

---

Stage 2 — Execution

Attacker goal: Run code on a host under a compromised user or process context.

Preventive controls:

• Intune MDM policy (app allowlisting where feasible)
• Cortex XDR file-based and behavioral prevention
• ASR (Attack Surface Reduction) rules via Intune
• AppLocker / WDAC on sensitive servers (scope being reviewed)

Detective controls:

• EventID 4688 process creation (kill-chain Phase 1 enabling — Intune on home computers, GPO on AD-joined servers)
• PowerShell 4103 / 4104 script block logging
• Cortex XDR behavioral (LSASS access, unusual parent-child)
• Planned: kill-chain Execution agent — watches 4688 for mimikatz, cobalt, mshta, wscript, rundll32 from unexpected parents

Gap: 4688 coverage not yet complete on all host populations. Execution agent in build. Tracking in compliance scorecard row 50.

---

Stage 3 — Persistence

Attacker goal: Survive reboot, credential rotation, and endpoint reimaging.

Preventive controls:

• Limited local admin rights on workstations (Intune)
• GPO-driven startup restrictions
• Admin-approval required for service installation on production servers

Detective controls:

• EventID 7045 new service creation
• EventID 4698 new scheduled task
• EventID 5136/5137 GPO modification
• Registry-level FIM on run keys
• Planned: kill-chain Persistence agent — any new persistence outside CM window = HIGH

Gap: FIM coverage verification in-progress (compliance scorecard row 49). Persistence agent design complete; implementation pending.

---

Stage 4 — Credential Access / Dumping

Attacker goal: Steal authentication material (NTLM hashes, Kerberos tickets, browser tokens, cloud access tokens).

Preventive controls:

• Credential Guard on domain-joined Windows
• LSASS protection (PPL)
• No password reuse policy
• Keeper Security for privileged credentials
• KRBTGT rotation cadence

Detective controls:

• EventID 4688 with process name "lsass" access + unusual caller (Cortex XDR behavioral)
• EventID 4624 multi-target authentication pattern (planned agent)
• EventID 4662 object access — SACL on directory object for DCSync (scheduled)
• Cortex XDR behavioral detection of credential-dump binaries
• Planned: kill-chain Credential-dumping agent — fires CRITICAL on 4688 LSASS access pattern or 4624 multi-target

Gap: DCSync detection (CJ-5) is the highest-priority gap. SACL needs to be configured and 4662 needs to route to the agent.

---

Stage 5 — Lateral Movement

Attacker goal: Move from the initial foothold to higher-value targets (DC, file server, DB host).

Preventive controls:

• Network segmentation (VNets not peered across environments; Palo Alto east-west)
• Tier model — Tier 0 (DCs) isolated from Tier 1 (servers) from Tier 2 (workstations) — partial; consolidation plan pending
• Admin workstations only for privileged sessions

Detective controls:

• EventID 4624 / 4648 explicit credentials from workstation to server
• EventID 5140 admin share access (C$, ADMIN$)
• Palo Alto east-west traffic logs (Panorama visibility)
• Planned: kill-chain Lateral-movement agent — same account hitting 3+ machines in 30 min, explicit creds workstation-to-server

Gap: Lateral-movement agent in build. East-west logging is comprehensive; detection logic is the pending piece.

---

Stage 6 — Exfiltration

Attacker goal: Move stolen data out (PHI, credentials, source code, configuration).

Preventive controls:

• Palo Alto App-ID blocks unapproved apps (RClone, WinSCP, Mega by policy)
• DLP on SharePoint and OneDrive for PHI keywords
• Egress limited to approved destinations where feasible
• DNS Security blocks known C2 domains

Detective controls:

• Palo Alto traffic logs — outbound bytes vs baseline
• DNS Security + URL filtering logs in LAW
• M365 audit log for Graph API bulk operations
• UBA baseline (in build) — daily 7-day rolling anomalies per entity
• Planned: kill-chain Exfiltration agent — outbound volume anomalies, new destinations, large transfers outside business hours

Gap: UBA baseline + exfiltration agent in active development. Manual Palo Alto traffic analysis is the current surface.

---

Stage 7 — Defense Evasion

Attacker goal: Silence detection tooling, clear logs, disable agents, avoid telemetry.

Preventive controls:

• Cortex XDR tamper protection
• 6-year WORM/Object Lock audit archive — adversary cannot delete logs that already shipped
• Log DCR sends to multiple destinations (LAW + archive)
• Intune enforces agent presence on managed endpoints

Detective controls:

• EventID 1102 Security log cleared — fires CRITICAL immediately
• Cortex XDR "silence" detection — 0 findings over a period while other agents are elevated = HIGH (on the backlog)
• Agent heartbeat monitoring in SecOps
• LAW ingestion anomaly detection (on the backlog)

Gap: Cortex silence escalation in backlog; LAW ingestion anomaly detection not yet built.

---

Stage 8 — Impact (Encryption / Destruction)

Attacker goal: Execute ransomware, corrupt data, destroy backups, demand payment.

Preventive controls:

• Cortex XDR behavioral ransomware prevention
• Intune device compliance blocks untrusted endpoints from corporate data
• Veeam + RSV + S3 Object Lock redundant immutable backup (CJ-8)
• No path for attacker from user network to backup management network

Detective controls:

• Cortex XDR ransomware behavioral detection
• FIM alerts on mass file modification in sensitive paths
• Veeam job failure alerts (if backups being deleted/encrypted)
• SecOps aggregate volume alerts on document mass-delete

Gap: FIM coverage for ransomware-relevant paths to be verified as part of the kill-chain workstream (compliance scorecard row 49).

---

Aggregate coverage scoring

Stage	Preventive	Detective	Overall
1. Initial Access	STRONG	STRONG	GOOD (FIDO2 gap)
2. Execution	MEDIUM	PARTIAL	GAP (4688 + agent in build)
3. Persistence	MEDIUM	PARTIAL	GAP (FIM + agent)
4. Credential Access	STRONG	PARTIAL	GAP (DCSync detection)
5. Lateral Movement	STRONG	PARTIAL	GAP (agent in build)
6. Exfiltration	STRONG	PARTIAL	GAP (UBA + agent in build)
7. Defense Evasion	STRONG	MEDIUM	GAP (silence escalation)
8. Impact	STRONG	MEDIUM	GAP (FIM verification)

The pattern is consistent: preventive coverage is strong; detective coverage for stages 2–8 is the active investment area. The kill-chain workstream (CLAUDE.md current priorities #2 and #3) closes the majority of these in Q2.

Document history

Date	Change	Author
April 2026	Initial controls mapping across 8 kill chain stages	Kobe