A transit analyst treats Lockheed Martin Kill Chain "C2" and MITRE ATT&CK "Command and Control" as the same vocabulary. What distinction should the analyst keep?
Select an answer to reveal the explanation.
Short Explanation
Same neighborhood, different street maps. Kill Chain C2 is a stage in a seven-step story; ATT&CK Command and Control is a tactic drawer stuffed with techniques. Do not mash the two dictionaries into one.
Full Explanation
Lockheed Martin Kill Chain "C2" and MITRE ATT&CK "Command and Control" sound similar but belong to different maps. Kill Chain C2 is one stage in a sequential campaign narrative (after exploitation and installation, before actions on objectives). ATT&CK Command and Control is a tactic—a drawer that contains many techniques (application layer protocol, encrypted channel, traffic signaling, and more). A transit analyst should keep that distinction so stage storytelling and technique hunting do not get mashed into one dictionary.
Treating the two names as identical frameworks so every Kill Chain stage equals an ATT&CK technique ID fails by category error—stages are not technique IDs. Calling Kill Chain C2 an ES annotation type and ATT&CK Command and Control a sourcetype confuses frameworks with Splunk content metadata and data plumbing. Claiming ATT&CK replaces the Kill Chain so civic SOCs must retire stage language overstates exclusivity; many programs use Kill Chain for narrative and ATT&CK for technique detail together.
Exam caveat: similar English labels across frameworks are a common trap; always ask whether the stem means a campaign stage or an ATT&CK tactic with child techniques.
Operational check: in transit incident reports, use Kill Chain stages for executive timeline slides and ATT&CK tactic/technique IDs on ES notables and hunt packages; never store Kill Chain stage numbers as sourcetypes or assume stage equals technique ID.