MalChain Detections GitHub

Chain Linking

How actions in one phase enable the next, forming a deterministic chain from initial access to impact. Each capability below shows the state transition it produces and the techniques it most commonly enables.

STATE PROPAGATION — each phase consumes the output of the one before itIngressAccessActivationExecutionAnchoringPersistenceConcealmentEvasionExpansionReachExtractionImpact
Interactive linkage mapTrace all 156 technique-to-technique links across the chain.

IngressING

How malware enters systems. 7 techniques.

01Removable Media & File Transfer
INGRESS → Media Delivery → Trust Establishment → ACTIVATION.
ACT-01 User-Executed FilesACT-02 Script-Based ExecutionACT-04 DLL Side-Loading or Hijacking
02Malvertising & Drive-By Downloads
INGRESS → Web Exposure → Silent Payload Delivery → ACTIVATION.
ACT-02 Script-Based ExecutionACT-01 User-Executed FilesACT-04 DLL Side-Loading or Hijacking
03Supply Chain Compromise
INGRESS → Trusted Update or Dependency → ACTIVATION.
ACT-03 Service-Based ExecutionACT-04 DLL Side-Loading or HijackingANC-07 Fileless & In-Memory Persistence
04Credential Abuse
INGRESS → Authenticated Access → ACTIVATION.
ACT-03 Service-Based ExecutionACT-05 WMI-Based ExecutionEXP-10 Cloud & Hybrid Lateral Movement
05Malicious or Compromised USB Devices
INGRESS → Peripheral Trust → Automatic Device Execution → ACTIVATION
ACT-02 Script-Based ExecutionACT-01 User-Executed FilesING-04 Credential Abuse
06Watering Hole Attacks
INGRESS → Targeted Web Exposure → ACTIVATION.
ACT-02 Script-Based ExecutionING-04 Credential AbuseACT-04 DLL Side-Loading or Hijacking
07External Remote Services
INGRESS → Authenticated Remote Access → ACTIVATION.
ACT-03 Service-Based ExecutionING-04 Credential AbuseEXP-01 Living-off-the-Land Lateral Movement

ActivationACT

Running malicious code. 7 techniques.

01User-Executed Files
ACTIVATION → Code Executing → reinforced within ACTIVATION.
ACT-02 Script-Based ExecutionACT-04 DLL Side-Loading or HijackingANC-01 Startup & Logon Execution
02Script-Based Execution
ACTIVATION → Code Executing → reinforced within ACTIVATION.
ACT-03 Service-Based ExecutionACT-04 DLL Side-Loading or HijackingANC-02 Scheduled & Triggered Execution
03Service-Based Execution
ACTIVATION → Code Executing → ANCHORING.
ACT-04 DLL Side-Loading or HijackingANC-02 Scheduled & Triggered ExecutionANC-03 Service & Daemon Persistence
04DLL Side-Loading or Hijacking
ACTIVATION → Code Executing → CONCEALMENT.
ACT-05 WMI-Based ExecutionANC-04 Registry-Based PersistenceCON-06 Process Injection
05WMI-Based Execution
ACTIVATION → Code Executing → EXPANSION.
ACT-06 Browser Extension ExecutionANC-06 WMI & Event Subscription PersistenceEXP-01 Living-off-the-Land Lateral Movement
06Browser Extension Execution
ACTIVATION → Code Executing → EXTRACTION.
ACT-07 Boot / Firmware ExecutionANC-05 Browser-Based PersistenceEXT-04 Messaging and Social Platform Channels
07Boot / Firmware Execution
ACTIVATION → Code Executing → ANCHORING.
ANC-01 Startup & Logon ExecutionANC-08 Boot & Pre-OS PersistenceCON-05 Environment & Sandbox Evasion

AnchoringANC

Maintaining presence. 8 techniques.

01Startup & Logon Execution
ANCHORING → Presence Assured → reinforced within ANCHORING.
ANC-02 Scheduled & Triggered ExecutionANC-04 Registry-Based PersistenceCON-08 Log & Artifact Manipulation
02Scheduled & Triggered Execution
ANCHORING → Presence Assured → reinforced within ANCHORING.
ANC-03 Service & Daemon PersistenceANC-04 Registry-Based PersistenceCON-08 Log & Artifact Manipulation
03Service & Daemon Persistence
ANCHORING → Presence Assured → CONCEALMENT.
ANC-04 Registry-Based PersistenceCON-08 Log & Artifact ManipulationEXP-04 Remote Service & Protocol Abuse
04Registry-Based Persistence
ANCHORING → Presence Assured → CONCEALMENT.
ANC-05 Browser-Based PersistenceCON-08 Log & Artifact ManipulationEXP-07 Privilege Escalation Across Hosts
05Browser-Based Persistence
ANCHORING → Presence Assured → CONCEALMENT.
ANC-06 WMI & Event Subscription PersistenceCON-08 Log & Artifact ManipulationEXT-04 Messaging and Social Platform Channels
06WMI & Event Subscription Persistence
ANCHORING → Presence Assured → CONCEALMENT.
ANC-07 Fileless & In-Memory PersistenceCON-08 Log & Artifact ManipulationEXP-01 Living-off-the-Land Lateral Movement
07Fileless & In-Memory Persistence
ANCHORING → Presence Assured → CONCEALMENT.
ANC-08 Boot & Pre-OS PersistenceCON-06 Process InjectionEXT-07 Encrypted Command-and-Control Channels
08Boot & Pre-OS Persistence
ANCHORING → Presence Assured → CONCEALMENT.
CON-01 Obfuscation & PackingCON-05 Environment & Sandbox EvasionEXP-08 Identity & Trust Relationship Abuse

ConcealmentCON

Avoiding detection. 10 techniques.

01Obfuscation & Packing
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-02 Fileless Malware ExecutionCON-06 Process InjectionCON-07 Polymorphism & Metamorphism
02Fileless Malware Execution
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-03 Security Tool TamperingCON-06 Process InjectionEXT-07 Encrypted Command-and-Control Channels
03Security Tool Tampering
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-04 Masquerading & ImpersonationCON-08 Log & Artifact ManipulationEXP-07 Privilege Escalation Across Hosts
04Masquerading & Impersonation
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-05 Environment & Sandbox EvasionCON-08 Log & Artifact ManipulationEXP-08 Identity & Trust Relationship Abuse
05Environment & Sandbox Evasion
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-06 Process InjectionCON-07 Polymorphism & MetamorphismEXP-01 Living-off-the-Land Lateral Movement
06Process Injection
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-07 Polymorphism & MetamorphismCON-08 Log & Artifact ManipulationEXP-07 Privilege Escalation Across Hosts
07Polymorphism & Metamorphism
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-08 Log & Artifact ManipulationCON-10 Anti-Forensics & CleanupEXT-10 Multi-Channel Redundant Exfiltration
08Log & Artifact Manipulation
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-09 Living-off-the-Land for EvasionCON-10 Anti-Forensics & CleanupEXT-10 Multi-Channel Redundant Exfiltration
09Living-off-the-Land for Evasion
CONCEALMENT → Visibility Degraded → reinforced within CONCEALMENT.
CON-10 Anti-Forensics & CleanupEXP-01 Living-off-the-Land Lateral MovementEXT-10 Multi-Channel Redundant Exfiltration
10Anti-Forensics & Cleanup
CONCEALMENT → Visibility Degraded → EXPANSION.
EXP-01 Living-off-the-Land Lateral MovementEXT-10 Multi-Channel Redundant ExfiltrationCON-08 Log & Artifact Manipulation

ExpansionEXP

Spreading within networks. 10 techniques.

01Living-off-the-Land Lateral Movement
EXPANSION → Foothold Widened → reinforced within EXPANSION.
EXP-02 Credential Reuse & RelayEXP-07 Privilege Escalation Across HostsEXT-01 HTTP / HTTPS Data Exfiltration
02Credential Reuse & Relay
EXPANSION → Foothold Widened → reinforced within EXPANSION.
EXP-03 Pass-the-Hash / Pass-the-TicketEXP-08 Identity & Trust Relationship AbuseEXT-02 DNS Tunneling
03Pass-the-Hash / Pass-the-Ticket
EXPANSION → Foothold Widened → reinforced within EXPANSION.
EXP-04 Remote Service & Protocol AbuseEXP-08 Identity & Trust Relationship AbuseEXT-07 Encrypted Command-and-Control Channels
04Remote Service & Protocol Abuse
EXPANSION → Foothold Widened → reinforced within EXPANSION.
EXP-05 Network Share PropagationEXP-07 Privilege Escalation Across HostsEXT-01 HTTP / HTTPS Data Exfiltration
05Network Share Propagation
EXPANSION → Foothold Widened → reinforced within EXPANSION.
EXP-06 Worm-like Self-PropagationEXP-07 Privilege Escalation Across HostsEXT-05 FTP / SFTP / FTPS Transfer
06Worm-like Self-Propagation
EXPANSION → Foothold Widened → reinforced within EXPANSION.
EXP-07 Privilege Escalation Across HostsEXP-08 Identity & Trust Relationship AbuseEXT-10 Multi-Channel Redundant Exfiltration
07Privilege Escalation Across Hosts
EXPANSION → Foothold Widened → reinforced within EXPANSION.
EXP-08 Identity & Trust Relationship AbuseEXP-09 Directory Services TargetingEXT-07 Encrypted Command-and-Control Channels
08Identity & Trust Relationship Abuse
EXPANSION → Foothold Widened → reinforced within EXPANSION.
EXP-09 Directory Services TargetingEXP-10 Cloud & Hybrid Lateral MovementEXT-01 HTTP / HTTPS Data Exfiltration
09Directory Services Targeting
EXPANSION → Foothold Widened → EXTRACTION.
EXP-10 Cloud & Hybrid Lateral MovementEXT-04 Messaging and Social Platform ChannelsEXT-07 Encrypted Command-and-Control Channels
10Cloud & Hybrid Lateral Movement
EXPANSION → Foothold Widened → EXTRACTION.
EXT-01 HTTP / HTTPS Data ExfiltrationEXT-03 Cloud Storage AbuseEXT-10 Multi-Channel Redundant Exfiltration

ExtractionEXT

Stealing data. 10 techniques.

01HTTP / HTTPS Data Exfiltration
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-02 DNS TunnelingEXT-03 Cloud Storage AbuseEXT-10 Multi-Channel Redundant Exfiltration
02DNS Tunneling
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-03 Cloud Storage AbuseEXT-06 Tor / Proxy / VPN Anonymization ChannelsEXT-10 Multi-Channel Redundant Exfiltration
03Cloud Storage Abuse
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-04 Messaging and Social Platform ChannelsEXT-07 Encrypted Command-and-Control ChannelsEXT-10 Multi-Channel Redundant Exfiltration
04Messaging and Social Platform Channels
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-05 FTP / SFTP / FTPS TransferEXT-06 Tor / Proxy / VPN Anonymization ChannelsEXT-10 Multi-Channel Redundant Exfiltration
05FTP / SFTP / FTPS Transfer
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-06 Tor / Proxy / VPN Anonymization ChannelsEXT-07 Encrypted Command-and-Control ChannelsEXT-10 Multi-Channel Redundant Exfiltration
06Tor / Proxy / VPN Anonymization Channels
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-07 Encrypted Command-and-Control ChannelsEXT-10 Multi-Channel Redundant ExfiltrationCON-10 Anti-Forensics & Cleanup
07Encrypted Command-and-Control Channels
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-08 Removable Media Data ExtractionEXT-09 Steganographic Data TransferEXT-10 Multi-Channel Redundant Exfiltration
08Removable Media Data Extraction
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-09 Steganographic Data TransferEXT-10 Multi-Channel Redundant ExfiltrationCON-10 Anti-Forensics & Cleanup
09Steganographic Data Transfer
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
EXT-10 Multi-Channel Redundant ExfiltrationCON-10 Anti-Forensics & CleanupEXT-01 HTTP / HTTPS Data Exfiltration
10Multi-Channel Redundant Exfiltration
EXTRACTION → Impact Realized → reinforced within EXTRACTION.
CON-10 Anti-Forensics & CleanupEXT-08 Removable Media Data ExtractionEXT-07 Encrypted Command-and-Control Channels