Guide · Agent skill
How to use the Cyber Kill Chain Analysis agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The analyzing-cyber-kill-chain skill teaches an AI agent to analyze an intrusion using the Lockheed Martin Cyber Kill Chain, a seven-step model of how attacks progress from reconnaissance to achieving objectives. This guide explains what the skill does, how to install it, how to trigger it, and what it needs. After reading it you will be able to load the skill, ask for a kill chain analysis of an incident, and know what input to supply.
Cyber Kill Chain Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the skill ZIP from this page and keep it somewhere you can find it.
- 2Unzip the skill. Unzip it into ~/.claude/skills/ for personal use, or into your project's .claude/skills/ folder.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Confirm Python 3. Make sure Python 3 is installed, because the skill runs scripts/agent.py.
- 5Gather the timeline. Collect the incident timeline and forensic artifacts you want analyzed, with timestamps where possible.
- 6Ask for the analysis. Send a natural request such as mapping your timeline to the Lockheed Martin Cyber Kill Chain.
- 7Review the report. Check each phase call against your evidence and use the recommendations to plan controls.
What is an agent skill and what does this one do?
An agent skill is a folder containing a SKILL.md file with instructions, and optionally scripts and reference files, that an AI agent loads when a request matches the skill's description. This skill is defined in SKILL.md and uses the Lockheed Martin Cyber Kill Chain as its framework.
Once installed, the agent sorts observed activity from an incident into the seven kill chain phases, notes which phases the attacker completed and where defenses worked or failed, and recommends controls that could have stopped the attack earlier. The controls are grouped as detect, deny, disrupt, degrade, deceive and destroy. It can also produce a structured report for non-technical stakeholders and cross-reference MITRE ATT&CK techniques.
- Phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives
- Output: phase matrix, phase-by-phase analysis with evidence, detection point analysis, prioritized recommendations, control improvement roadmap
- Files: SKILL.md, scripts/agent.py, references/api-reference.md
Install the skill (ZIP download or Claude apps upload)
Download the ZIP of the skill from this page and unzip it. For a personal install, place the skill folder in ~/.claude/skills/. For a single project, place it in the project's .claude/skills/ folder instead.
If you use the Claude apps, you can instead upload the skill under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Project only: unzip into your project's .claude/skills/
- Claude apps: Settings → Capabilities → Skills, then upload
~/.claude/skills/analyzing-cyber-kill-chain/Check the requirements before you start
The skill runs scripts/agent.py, so Python 3 must be available on your machine. The skill does not use the network. It works from a timeline and artifacts you provide, and it does not query your systems.
You also need an incident timeline or forensic artifacts mapped to adversary actions. Optional tools named in the skill are MITRE ATT&CK Navigator, Elastic, Splunk and MISP, if you use them in your analysis.
- Python 3 (to run scripts/agent.py)
- An incident timeline or forensic artifacts you supply
- Optional: MITRE ATT&CK Navigator, Elastic, Splunk or MISP
How to trigger the skill with natural requests
Describe the incident and ask for a kill chain analysis. The SKILL.md description activates on requests about kill chain analysis, intrusion kill chain, attack phase mapping or the Lockheed Martin kill chain framework, and on post-incident analysis or mapping detection gaps to phases.
Give the agent your timeline first. Without observed actions, it cannot place activity into phases.
- "Map this incident timeline to the Lockheed Martin Cyber Kill Chain and tell me which phases the attacker completed."
- "Do a kill chain analysis of this phishing-to-persistence incident and identify where we could have detected it earlier."
- "Find the detection gaps in this incident by kill chain phase."
- "Write a kill chain report on this breach for non-technical executives."
Example workflow: from timeline to report
A typical run follows the skill's workflow. The agent maps each observed action to a phase, builds a phase matrix showing what was completed, detected or not achieved, maps phases to MITRE ATT&CK tactics, and lists courses of action per phase. It then writes the report in the order the skill specifies: attack narrative, phase analysis with evidence, detection point analysis, prioritized recommendations and a roadmap.
A phase matrix might look like this, where Installation is the phase at which the attack was stopped:
- Phase 3 Delivery: completed, phishing email bypassed the secure email gateway
- Phase 5 Installation: detected when EDR flagged scheduled task creation, attack stalled
- Phase 6 and 7: not achieved
Phase 5: Install → DETECTED: EDR flagged scheduled task creation (attack stalled here)Tips for better results
Use the skill for post-incident work and prevention planning, not live response, because it does not monitor your environment. Combine it with MITRE ATT&CK for technique-level detail, since the skill says the 7-phase model alone is not enough.
Expect it to assume familiarity with logs, IOCs, EDR and SIEM tools. Treat insider cases carefully: the skill notes they may skip straight to Actions on Objectives.
- Supply exact timestamps and artifacts, not summaries
- Keep kill chain phases separate from ATT&CK tactics; they are related but not equivalent
- Note phases you cannot see, such as reconnaissance, and mark them as needing external intelligence
Safety notes on scripts and network access
This skill runs scripts (scripts/agent.py). Read the script before running it, and run it in an environment you trust. The skill's stated network use is none, so it should not send your incident data out, but verify this against the script yourself.
Incident timelines often contain sensitive data. Remove credentials, personal data and customer identifiers before you share them with the agent.
- Review scripts/agent.py before use
- Network use is listed as none
- Redact sensitive data from timelines
What people use it for
- Writing a post-incident report that shows how far an attacker progressed through the kill chain
- Identifying which phase a defense stopped and why, to reinforce that control
- Planning prevention controls and finding detection gaps by attack phase
- Producing a non-technical summary of a breach for executives
Frequently asked questions
How do I install the analyzing-cyber-kill-chain skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.
What do I need to run it?
You need Python 3 to run scripts/agent.py, plus an incident timeline or forensic artifacts you supply. Optional tools are MITRE ATT&CK Navigator, Elastic, Splunk or MISP.
Is this skill free and what is its licence?
The skill is listed under the Apache-2.0 licence. Check the licence file in the repository for the full terms.
Does the skill monitor my network in real time?
No. It works from a timeline and artifacts you provide and does not query your systems, so it is for post-incident analysis and planning rather than live response.
Can I use the kill chain on its own without MITRE ATT&CK?
The skill says not to use the kill chain as a standalone framework. Combine it with MITRE ATT&CK for technique-level detail beyond the seven phases.
What if the skill does not activate when I ask?
Use wording from the skill description, such as kill chain analysis, intrusion kill chain, attack phase mapping or Lockheed Martin kill chain framework, and make sure the skill folder sits in the correct skills directory.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you are a security analyst or incident responder writing post-incident reports or planning controls by attack phase, and you can supply a timeline. Pick something else if you need live attack response or you are not familiar with logs, IOCs, EDR and SIEM tools.
Download the skill