Kill Chain Atlas — O/IT Cyber

Step 1 (Enterprise): T1566 — Spearphishing engineer mailboxes.

Step 2 (Enterprise): T1059 — PowerShell loader on EWS.

Step 3 (Enterprise): T1003 — LSASS dump for domain creds.

Step 4 (Enterprise): T1021 — RDP across the corporate domain.

Step 5 (Enterprise): T1018 — Locate engineering workstations.

Step 6 (ICS): T0822 — Cross DMZ via legitimate remote service.

Step 7 (ICS): T0867 — Stage Industroyer2 on the EWS.

Step 8 (ICS): T0853 — Run IEC-104 module against substation RTUs.

Step 9 (ICS): T1692.001 — Unauthorized OPEN commands to breakers.

Step 10 (ICS): T0814 — CaddyWiper variant denies SCADA recovery.

Step 11 (ICS): T0826 — Loss of availability — substation offline.

Step 12 (ICS): T0813 — Operators unable to re-close breakers remotely.