Understanding Mandiant Attack Lifecycle

The Mandiant Attack Lifecycle describes the systematic progression that sophisticated, targeted adversaries follow from their initial entry into the environment through to the achievement of their long-term objectives. Developed by Mandiant from the accumulated intelligence of hundreds of incident response engagements with the most advanced threat actors operating globally, the model reflects the operational reality of the persistent adversary rather than the opportunistic attacker whose single-stage compromise the simpler intrusion model adequately characterises. Where the opportunistic attacker seeks the quick win and moves on when the initial access does not immediately yield the desired outcome, the persistent adversary invests the time, the patience, and the operational sophistication required to establish the deep access, the redundant persistence, and the comprehensive internal intelligence that the high-value objective demands.

The framework’s distinctive governance contribution for the SOC is the emphasis on the adversary’s internal campaign whose multiple phases between the initial intrusion and the mission completion create the detection opportunities that the perimeter-focused security architecture misses entirely. The adversary who has bypassed the perimeter defence does not immediately achieve the mission. They must establish the foothold, escalate the privileges, conduct the internal reconnaissance, move laterally to the target systems, and maintain the presence throughout the operation whose duration the long-term objective demands. Each of these internal phases creates the detection opportunity whose identification the Mandiant Attack Lifecycle’s structured model makes visible as the defensive intervention point that the kill chain’s perimeter-focused perspective does not address with the same internal campaign detail.

The Eight Phases #

Initial Reconnaissance #