A transit analyst treats Lockheed Martin Kill Chain "C2" and MITRE ATT&CK "Command and Control" as the same vocabulary. What distinction should the analyst keep?
Select an answer to reveal the explanation.
Short Explanation
Same neighborhood, different street maps. Kill Chain C2 is a stage in a seven-step story; ATT&CK Command and Control is a tactic drawer stuffed with techniques. Do not mash the two dictionaries into one.
Full Explanation
The Cyber Kill Chain and MITRE ATT&CK can both describe command-and-control activity, but they are not identical vocabularies: Kill Chain C2 is one sequential campaign stage, while ATT&CK Command and Control is a tactic that contains many techniques. Neither name is an ES annotation type or a sourcetype, and ATT&CK does not legally retire Kill Chain stage language. Civic analysts should map across frameworks without collapsing them.