Ransomware kill chain mapped to the controls that interrupt each step

The encryption is the part of a ransomware incident everyone sees, and it is the last step. By the time files are renamed and a note appears, the intruder has usually been inside for a while: they got in, ran tools, took credentials, found the file servers, spread, switched off what could see them, and often copied data out first. Each of those steps is a place to stop the incident before the part that makes the news. This article maps eight stages to MITRE ATT&CK techniques and to the mitigations ATT&CK links to them, cross-checked against the #StopRansomware Guide from CISA, MS-ISAC, NSA and FBI. It ships a short script that reads ATT&CK's own data file and tells you which stages the controls you already run leave uncovered. It is written for people defending their own networks, and it describes each stage only as far as recognising and closing it requires.

Why a chain, not an event

ATT&CK's entry for the final step, T1486 Data Encrypted for Impact (version 1.5, last modified 12 May 2026), says encrypting malware may "propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares." The encryption depends on earlier techniques having already worked. The technique is also not rare: counting the relationships in the ATT&CK 19.2 data file, we found 62 malware entries, 19 groups and 4 campaigns recorded as using T1486.

The CISA guide makes the same point from the responder's side: "A ransomware infection may be evidence of a previous, unresolved network compromise," and in some cases deployment "is the last step in a network compromise." It adds that actors have "exfiltrated victim data and pressured victims to pay by threatening to release the stolen data", which it calls double extortion, and that some skip the encryption entirely.

The practical consequence has two halves. Prevention does not have to win at every stage; it has to win at one stage before impact. Recovery has to work at the end regardless, because you will not know in advance which earlier stage failed.

The eight stages

We built the chain from the structure of the CISA guide (its six initial access vectors in Part 1 and the threat-hunting list in Part 2) and expressed each stage as Enterprise ATT&CK technique IDs from release 19.2, which MITRE tagged in its attack-stix-data repository on 5 August 2026. The choice of techniques is ours; ATT&CK does not publish one canonical ransomware chain, and you should edit the list to match your environment.

#	Stage	ATT&CK techniques in the mapping	Where the CISA guide covers it
1	Initial access	T1133 External Remote Services, T1190 (public-facing applications), T1078 Valid Accounts, T1566 Phishing, T1199 Trusted Relationship	Part 1, the six initial access vectors
2	Execution and remote control	T1059.001 PowerShell, T1219 Remote Access Tools	Part 1, PowerShell and RMM hardening
3	Credential access	T1003.001 LSASS Memory, T1110 Brute Force	Part 1, compromised credentials
4	Discovery	T1482 Domain Trust Discovery, T1018 Remote System Discovery	Part 2, threat hunting
5	Lateral movement	T1021.001 Remote Desktop Protocol, T1021.002 SMB/Windows Admin Shares	Part 1, SMB and RDP guidance
6	Defense impairment	T1685 Disable or Modify Tools	Part 1, logging; Part 2, hunting
7	Exfiltration	T1567.002 Exfiltration to Cloud Storage, T1048 Exfiltration Over Alternative Protocol	Part 2, signs of exfiltration
8	Impact	T1490 Inhibit System Recovery, T1486 Data Encrypted for Impact	Part 1, backups; Part 2, recovery

Stage by stage: what closes it

1. Initial access. The CISA guide groups prevention by six vectors: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware infection, advanced forms of social engineering, and third parties and managed service providers. The first items are plain. Do not expose remote desktop to the internet, scan internet-facing devices regularly and patch them first, and put phishing-resistant MFA on "email, VPNs, and accounts that access critical systems" (CPG 2.H). Where a VPN cannot have MFA yet, the guide asks for passwords of 15 or more characters. In ATT&CK, T1133's mitigations include M1032 Multi-factor Authentication and M1035 Limit Access to Resource Over Network, and T1190's include M1051 Update Software and M1016 Vulnerability Scanning.

2. Execution and remote control. Once inside, intruders run scripts and install remote monitoring and management (RMM) software to keep a hand on the network. The guide asks for PowerShell restricted by Group Policy to the people who manage systems, earlier versions uninstalled, module, script block and transcription logging turned on, and the two PowerShell event logs retained for at least 180 days. For RMM it asks you to inventory the authorised tools, review logs for RMM running as a portable executable, and block common RMM ports at the perimeter. Application allowlisting, M1038 Execution Prevention in ATT&CK terms, sits behind both.

3. Credential access. Domain-wide encryption needs domain-wide credentials. The guide's list: the Attack Surface Reduction rule for LSASS, Credential Guard, LAPS for local administrator passwords, account lockout with logged failures, and administrator accounts kept separate from user accounts (CPG 2.E). ATT&CK attaches seven mitigations to T1003.001, among them M1043 Credential Access Protection and M1026 Privileged Account Management. The credential stuffing and MFA fatigue articles on this site cover the password side of this stage in more depth.

4. Discovery. This is the stage that cannot be configured away. In the 19.2 data, T1018 Remote System Discovery has no mitigation relationship at all, and T1482 Domain Trust Discovery has two, M1030 Network Segmentation and M1047 Audit. Listing hosts and domain trusts looks like ordinary administration, so the defence is visibility: centralised logs in a SIEM (CPG 2.U), kept for a year where possible, and a baseline of normal traffic so that two items from the guide's hunting list stand out, "enumeration of AD" and "unexpected endpoint-to-endpoint (including servers) communications".

5. Lateral movement. The guide's SMB section is the most concrete part of the document: disable SMBv1, block TCP 445 inbound and outbound at the internet perimeter, limit internal SMB so that workstations do not talk to other workstations, require SMB encryption or signing, and use Group Policy to stop local accounts signing in over the network. Network segmentation (CPG 2.F) is the structural version of the same idea. T1021.001, remote desktop, carries eight ATT&CK mitigations, tied with T1078 and T1190 for the most of any technique in this chain.

6. Defense impairment. Before encrypting, intruders try to switch off whatever would see it. ATT&CK v19, released in April 2026, split the old Defense Evasion tactic into Stealth and Defense Impairment, and in the 19.2 data the familiar T1562.001 is revoked in favour of T1685 Disable or Modify Tools. T1685's M1047 Audit mitigation is the most useful sentence in this whole mapping for a small team: "Periodically verify that tools are functioning appropriately – for example, that all expected hosts with EDRs or monitoring agents are checking in to the central console." The CISA guide asks the same of PowerShell logs, which should be checked "to confirm whether the log data has been deleted or logging has been turned off." An agent that stops reporting is an alert, not a ticket for next week.

7. Exfiltration. Backups do nothing about stolen data, which is why double extortion works. The guide's hunting list names what to look for: an "abnormal amount of data outgoing over any port", and tools including Rclone, Rsync, web-based file storage services and FTP/SFTP. ATT&CK gives T1567.002 Exfiltration to Cloud Storage a single mitigation, M1021 Restrict Web-Based Content, and T1048 six, including M1057 Data Loss Prevention and M1037 Filter Network Traffic. Egress control is its own line item; nothing earlier in the chain substitutes for it.

8. Impact. T1490 Inhibit System Recovery (version 1.6) describes intruders deleting volume shadow copies, backup catalogs and "online" backups reachable from the network. The guide's hunting list names the built-in Windows tools to watch for unusual use (bcdedit, fsutil, vssadmin, wbadmin and wmic), and ATT&CK's mitigations for T1490 include M1018 User Account Management: "Limit the user accounts that have access to backups to only those required." Against the encryption itself, the guide's first preparation item is to "Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups" (CPG 2.R), with maintained golden images of critical systems beside it. It gives the reason in one clause: "many ransomware variants attempt to find and subsequently delete or encrypt accessible backups."

What the count shows

Run over the chain above, the script writes 86 rows: 18 techniques across 8 stages, linked to 32 distinct ATT&CK mitigations. Ranking the mitigations by how many stages they reach gives a result that is useful precisely because it is unglamorous.

Bar chart of ATT&CK mitigations by number of ransomware-chain stages touched, led by User Account Management at six of eight — Mitigations linked to three or more of the eight stages, computed from Enterprise ATT&CK v19.2 by the script and dataset shipped with this article.

M1018 User Account Management reaches six of the eight stages through seven techniques. M1026 Privileged Account Management, M1030 Network Segmentation, M1042 Disable or Remove Feature or Program, M1037 Filter Network Traffic and M1047 Audit reach four stages each. Multi-factor authentication, M1032, reaches three stages through five techniques. Data Backup, M1053, reaches only one stage, impact, yet it is the only mitigation ATT&CK links to both impact techniques in the chain. Account hygiene, segmentation and audit span the intrusion; backups decide how the last stage ends.

Running the gap check on your own controls

Download the pinned data file from MITRE's repository once (53,835,637 bytes when we fetched it today), then pass the mitigation IDs you can actually point to:

curl -LO https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack-19.2.json
python ransomware-kill-chain-mapped-to-controls.py --bundle enterprise-attack-19.2.json --have M1032,M1053,M1051

We ran it with three controls, MFA, backups and software updates. An excerpt of the real output:

note: T1562.001 is revoked in ATT&CK 19.2; using T1685 Disable or Modify Tools
1. Initial access                 T1566      Phishing                                 GAP
2. Execution and remote control   T1059.001  PowerShell                               GAP
2. Execution and remote control   T1219      Remote Access Tools                      GAP
3. Credential access              T1110      Brute Force                              covered by M1032
4. Discovery                      T1482      Domain Trust Discovery                   GAP
6. Defense impairment             T1685      Disable or Modify Tools                  GAP
7. Exfiltration                   T1567.002  Exfiltration to Cloud Storage            GAP
8. Impact                         T1486      Data Encrypted for Impact                covered by M1053

Those three controls cover 8 of the 18 techniques and leave four whole stages with nothing: execution and remote control, discovery, defense impairment and exfiltration. --summary prints the ranking behind the chart, --out writes the CSV, --chart redraws the figure (it needs matplotlib), and --chain takes your own CSV of stage_order,stage,technique_id rows if your environment looks different, for example if you run ESXi hosts or cloud storage that the default list does not emphasise.

Limitations

A mitigation relationship in ATT&CK means the control is relevant to the technique. It says nothing about whether your configuration of it works, so every "covered by" line is a question to verify, not an answer.
Counting stages rewards broad controls and undercounts narrow, decisive ones. Backups score one stage and still decide whether recovery takes days or never happens.
The chain is a model. Real intrusions skip and repeat stages, and the CISA guide notes that some actors steal data without encrypting anything.
Technique IDs age. Mappings written before April 2026 cite T1562.001; the script follows ATT&CK's revoked-by links and says so, but a technique deprecated with no replacement is only reported as a warning.
This covers Enterprise ATT&CK only. The mobile and ICS matrices are separate datasets.

The dataset

_README for ransomware-kill-chain-mapped-to-controls.csv, one row per stage, technique and mitigation:

stage_order, stage: position (1 to 8) and name of the stage in this article's chain
technique_id: the current ATT&CK ID after following revocations
requested_id: the ID as listed in the input chain; it differs only where T1562.001 resolved to T1685
technique_name, tactics: the technique's name and its ATT&CK tactic short names, separated by semicolons
technique_version, technique_modified: the object's version and last-modified date in the data file
mitigation_id, mitigation_name: the linked mitigation; both empty where ATT&CK lists none (T1018)
attack_release, generated_at: the ATT&CK release read (19.2) and the date the file was produced (2026-09-12)

What to do this month

Run the gap check with the controls that are deployed and enforced today, not the ones on the roadmap.
For each stage that comes back empty, pick one mitigation from the CSV and give it an owner and a date.
Confirm every endpoint agent and log forwarder is checking in, and turn a silent one into an alert.
Restore one critical system from an offline backup, time it, and write the time down.
Take remote desktop off the internet and stop workstation-to-workstation SMB where nothing depends on it.

Encryption is the one stage where the only control left is a backup you have already tested. Every stage before it is a chance not to need that backup.