Attack Chain

Lesson plan

Level

Beginner

Time

About 65 minutes; the steps below add up to 67

Learners plan, from the attacker's side and on paper, the steps needed to get from a school's website to its pupil records, and see that removing one step stops the rest. Only then is the idea named, as a chain of dominoes. The six stages are taught in three short groups, each stage opening with a prediction where beginners go wrong: whether a stolen password means access, whether a reset ends an attacker's session, what can look odd about a valid sign-in, whether reading what an account already may read is escalation, and whether a backup undoes the harm. The overview diagram comes last, as a summary. The habit to build: at each stage, ask what the attacker needs next and where a control could stop or limit them.

Objectives

• Explain an attack chain as linked stages, each made possible by the one before
• Follow one attack from a phishing email to stolen or encrypted data
• Say at each stage what a defender might observe and which controls could interrupt it
• Tell a stolen password from successful access, and exfiltration from ransomware
• Explain why breaking one link helps but does not end the response

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the Threat Actors and Least Privilege lessons first.
• Have six blank boxes in a row on the board for the learners' list of steps; you will compare it with the lesson's six stages.
• Be clear that this is defensive reasoning: practical testing of any real system needs written permission.
• The lesson takes about 67 minutes. To teach it in two parts, stop after “Moving inside: stages 4 and 5”; the second part opens with “The objective: stage 6”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain an attack chain as linked stages, each made possible by the one before
   • Follow one attack from a phishing email to stolen or encrypted data
   • Say at each stage what a defender might observe and which controls could interrupt it
   • Tell a stolen password from successful access, and exfiltration from ransomware
   • Explain why breaking one link helps but does not end the response

   Purpose: Learners plan, from the attacker's side and on paper, the steps needed to get from a school's website to its pupil records, and see that removing one step stops the rest. Only then is the idea named, as a chain of dominoes. The six stages are taught in three short groups, each stage opening with a prediction where beginners go wrong: whether a stolen password means access, whether a reset ends an attacker's session, what can look odd about a valid sign-in, whether reading what an account already may read is escalation, and whether a backup undoes the harm. The overview diagram comes last, as a summary. The habit to build: at each stage, ask what the attacker needs next and where a control could stop or limit them.

2. 1. From one email to the records Think 6 min

   Purpose: Have learners construct a chain of dependent steps themselves, and see what removing one does.

   Ask

   • From the website to the records: what must the attacker achieve, in order?
   • Make one step fail. What happens to the rest?

   Responses to expect

   • Lists are often three or four steps; “sign in” and “find the records” are commonly merged. Ask what the attacker knows on first signing in.
   • Some think a determined attacker just skips ahead; ask what they would be missing.
   • On screen in turns: the opening question, its answer; then the question on removing one step, and its answer.

   Discussion pause: Collect the lists into the six boxes before moving on.

   In the lesson window

   • Think it through: What would the attacker need to achieve, one thing after another, to reach the records? List the steps in order.
   • Think it through: Suppose a defender makes one step on your list fail, for example by making a stolen password useless on its own. What happens to the steps after it?

3. 2. The idea Explain 5 min

   Purpose: Name the attack chain and introduce the scenario the lesson follows.

   Ask

   • How close was your list to six stages?

   Responses to expect

   • Privilege escalation is the stage learners most often miss.
   • On screen in turns: the opening; then one connected scenario: the school.

4. 3. Getting in: stages 1 to 3 Predict 14 min

   Purpose: Follow phishing, credential theft and remote access, with what defenders can observe and change at each.

   Ask

   • What could stop a member of staff typing into the fake page?
   • Password stolen: is the attacker in?
   • Password reset after the attacker signed in: locked out?
   • What could look odd about a valid sign-in?

   Responses to expect

   • “Training” is the usual first answer; push for the technology and the routine too.
   • Many say the reset locks the attacker out. Introduce sessions here if needed.
   • On screen in turns: the opening question, its answer; then stage 1: where controls help; stage 2: the question on a password in hand, and its answer; stage 2: what happens, what defenders see and where controls help; the check question on the reset password, and its answer; stage 3: remote access, and the question on a valid-looking sign-in, and its answer; stage 3: what defenders might observe, and where controls help.

   Misconceptions to challenge

   • A learner may believe: “A stolen password means the attacker got in.” Respond: MFA, policy and device checks can still refuse the sign-in.

   Discussion pause: At each stage, ask the class what the attacker needs next and what a defender could see, before revealing the lesson’s answer.

   If the explanation does not land: Compare a session to a wristband at a festival: changing the ticket office's rules does not take back wristbands already handed out.

   To go further

   • Which kind of MFA would still help if the attacker phoned the teacher and asked for the code?

   In the lesson window

   • Think it through: The message looks professional and seems to come from a familiar service. What could stop a member of staff typing their password into the fake page?
   • Think it through: The attacker now has a teacher’s username and password. Does that mean the attacker is in?
   • Check your understanding: The teacher’s password is reset an hour after the attacker signed in with it. Is the attacker now locked out?
   • Think it through: The sign-in used the right username and password. What might still look unusual about it to someone watching?

5. 4. Moving inside: stages 4 and 5 Predict 9 min

   Purpose: Separate looking around from being allowed in, and using existing permissions from gaining new ones.

   Ask

   • What limits which systems the attacker can actually reach?
   • Reading records the account could already read: escalation?

   Responses to expect

   • Most say yes to escalation because the act is harmful. Ask whether any new permission was gained.
   • On screen in turns: the opening question, its answer; then stage 4: where controls help; stage 5: privilege escalation, and the check question, and its answer; stage 5: what defenders might observe, and where controls help.

   If the explanation does not land: A visitor badge that opens the front door does not open every room: what the badge allows (least privilege) and which corridors connect (segmentation) both limit where the visitor can go.

   In the lesson window

   • Think it through: From the teacher’s account, the attacker can see a list of the school’s systems. What would limit which of them the attacker can actually reach and open?
   • Check your understanding: The teacher’s account was already allowed to read every pupil record, and the attacker reads them all. Is that privilege escalation?

6. 5. The objective: stage 6 Predict 9 min

   Purpose: Distinguish exfiltration from ransomware, and show the limits of restoring from backup; then review the whole path in the diagram.

   Ask

   • Files restored from last night's backup: is the harm undone?

   Responses to expect

   • Many say yes. Ask where the stolen copies are now.
   • Diagram: step through the whole path stage by stage as a recap, asking the class to name a defence before each stage’s text appears.
   • On screen in turns: the opening question, its answer; then exfiltration; ransomware; what reduces the impact, and what restoring cannot do; the whole path, one stage at a time; the diagram’s stages one at a time.

   Misconceptions to challenge

   • A learner may believe: “Exfiltration and ransomware are the same outcome.” Respond: One copies data out, the other denies access; an incident may involve both.
   • A learner may believe: “Restoring from backup undoes the attack.” Respond: It repairs availability, not disclosure, and does not prove the attacker has gone.

   In the lesson window

   • Think it through: The attacker has copied the records out and then locked the school’s files. The school restores every file from last night’s backup. Has the harm been undone?

7. 6. What this path leaves out Discover 5 min

   Purpose: Show that the six stages are a teaching path, not a universal model.

   Ask

   • How might a real attack differ from these six stages?

   Responses to expect

   • Pairs usually find skipping stages; persistence is the idea most often missed.
   • On screen in turns: the opening question, its answer; then how real attacks differ, starting with skipped stages; reconnaissance before the attack; a way back in; published models of attacks.

   Misconceptions to challenge

   • A learner may believe: “Every attack follows these six stages in order.” Respond: Stages are skipped, repeated and reordered.
   • A learner may believe: “The six stages are how every attack happens.” Respond: They are one teaching path. Real attacks skip, repeat and reorder stages, and research the target before the first message.

   In the lesson window

   • Think it through: Real attacks do not always follow these six stages. In what ways might one differ?

8. 7. Breaking the chain Predict 7 min

   Purpose: Show what a blocked route achieves and what it does not, and the support-desk response.

   Ask

   • Sign-in blocked: is the incident over?

   Responses to expect

   • Some say yes. Ask what the attacker still holds.
   • On screen in turns: the opening question, its answer; then two alternatives, and why defence is layered; what to do when a colleague reports entering their password; revoking sessions and checking sign-ins; finding other recipients.

   To go further

   • Put the five support-desk actions in order of urgency, and justify the order.

   In the lesson window

   • Think it through: The phishing worked and the password was stolen, but the remote-access policy rejects the attacker’s sign-in. Is the incident over?

9. 8. Apply it in a new situation Apply 4 min

   Purpose: Set up independent application, ideally on a later day.

   Ask

   • Who will try these now, and who later in the week?

   Responses to expect

   • The clinic question tests that escalation is not inevitable; the closed ticket tests the full response.
   • On screen in turns: the opening question, its answer; then the question on the closed ticket, and its answer.

   In the lesson window

   • Apply it: Attackers copy a clinic’s patient records through a receptionist’s stolen account. A manager says: “That can’t be right. Nobody ever got administrator rights.” What is wrong with this?
   • Apply it: After a phishing report, a support colleague changes the user’s password and closes the ticket. What has been missed?

10. 9. Check your understanding Check 4 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • The final-outcomes question is multiple-select.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

11. 10. Key takeaway Consolidate 4 min

    Purpose: Summarise the four questions for each stage, the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: name the six stages in order.

    Responses to expect

    • Phishing, credential theft, remote access, internal reconnaissance, privilege escalation, exfiltration or ransomware.
    • On screen in turns: the opening; then the summary; the key terms; the common misunderstandings.

12. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Each stage gives the attacker what the next one needs.
    • Holding a password is not being in; a reset is not the end of a session.
    • Seeing a system is not being allowed into it; using existing rights is not escalating.
    • Theft and lock-out are different outcomes, and a backup repairs only one.
    • Blocking one route is a success, not the end of the response.

Consolidation

• Each stage gives the attacker what the next one needs.
• Holding a password is not being in; a reset is not the end of a session.
• Seeing a system is not being allowed into it; using existing rights is not escalating.
• Theft and lock-out are different outcomes, and a backup repairs only one.
• Blocking one route is a success, not the end of the response.