Cyber Kill Chain Analysis
Maps a security incident onto the seven Lockheed Martin kill chain phases and suggests controls to stop it earlier.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent analyzes an intrusion or security incident using the Lockheed Martin Cyber Kill Chain, a model that breaks an attack into seven steps from reconnaissance to achieving objectives. It sorts observed activity into those phases, notes which phases the attacker completed and where defenses worked or failed, and recommends controls (detect, deny, disrupt, degrade, deceive, destroy) that could have stopped the attack earlier. It also produces a structured report suitable for non-technical stakeholders, and can cross-reference MITRE ATT&CK techniques.
Great for
- Security analysts writing post-incident reports after a breach
- Incident responders who want to show how far an attacker progressed
- Security teams planning prevention controls and detection gaps by attack phase
Skip it if
- Real-time attack response, because it works from a timeline and artifacts you supply rather than live monitoring (it does not query your systems)
- Use as a standalone framework: the skill itself says to combine it with MITRE ATT&CK for technique-level detail
- Non-security users: the content assumes familiarity with logs, IOCs, EDR and SIEM tools
Try asking
- “Map this incident timeline to the Lockheed Martin kill chain and tell me which phases the attacker completed.”
- “Where did our defenses fail in this phishing-to-ransomware case, and what would have stopped it at an earlier phase?”
- “Build a phase-by-phase defensive course-of-action table for our post-incident report.”
- “Which kill chain phases do our current detections cover, and where are the gaps?”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-cyber-kill-chain.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-cyber-kill-chain.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-cyber-kill-chain.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Provide a detailed, timestamped timeline with the forensic artifacts mapped to specific actions for much better phase mapping.
- Pair the output with MITRE ATT&CK for technique-level detail, as the skill recommends.
- Review the script's output before relying on it, since the phase mappings are general guidance and must be checked against your own evidence.
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.