Skip to content
HRM Framework 2.0 , home
Start the assessment

Level 3 · Sequences11 sequences12 ATT&CK tactics

Sequences.Risk developing over time.

Each sequence is a run of signals that happen in order, across MITRE ATT&CK tactics, inside a stated window, ending in a breach scenario. Choose one and watch a person move through the six stages; the player moves on to the next sequence by itself until you pause it.

SQ-ATO-015 stepsPeak: Stage 4 Suspected

Phish to takeover

  1. Step 01ATT&CK tactic: Initial Access

    Real phish delivered

    SE-T-02Real phishing delivered to inbox

    Stage 1Exposed

  2. Step 02ATT&CK tactic: Execution

    Link clicked

    SE-B-04Clicks links in real phishing

    Stage 3Exploited

  3. Step 03ATT&CK tactic: Persistence

    Unusual login

    IA-B-04Signs in from unusual contexts

    Stage 4Suspected

  4. Step 04ATT&CK tactic: Persistence

    New MFA device

    IA-B-05Approves MFA after repeated prompts

    Stage 4Suspected

  5. Step 05ATT&CK tactic: Lateral Movement

    Malicious mail sent from the account

    SE-T-06Account sending malicious or phishing mail

    Stage 4Suspected

  6. Breach scenarioHB-02

    Credential abuse & account takeover

    Inside 72 hours

Phish to takeover, 5 steps inside 72 hours: Real phish delivered (SE-T-02 Real phishing delivered to inbox, Initial Access, Stage 1 Exposed); then Link clicked (SE-B-04 Clicks links in real phishing, Execution, Stage 3 Exploited); then Unusual login (IA-B-04 Signs in from unusual contexts, Persistence, Stage 4 Suspected); then New MFA device (IA-B-05 Approves MFA after repeated prompts, Persistence, Stage 4 Suspected); then Malicious mail sent from the account (SE-T-06 Account sending malicious or phishing mail, Lateral Movement, Stage 4 Suspected). It leads to HB-02 Credential abuse & account takeover.

All 11 sequences

11 sequences, 6 breach scenarios.

The 11 sequences end in 6 of the 10 breach scenarios. Each card plays its steps in order; hover or focus it to play again.

  • SQ-ATO-015 steps · 72 hours

    Phish to takeover

    A real phishing message reaches the inbox, the person clicks the link, an unusual sign-in follows, a new MFA factor is approved after repeated prompts, and the account starts sending malicious mail, all within 72 hours.

    1. Step 1: Real phish delivered (SE-T-02 Real phishing delivered to inbox)
    2. Step 2: Link clicked (SE-B-04 Clicks links in real phishing)
    3. Step 3: Unusual login (IA-B-04 Signs in from unusual contexts)
    4. Step 4: New MFA device (IA-B-05 Approves MFA after repeated prompts)
    5. Step 5: Malicious mail sent from the account (SE-T-06 Account sending malicious or phishing mail)
    6. Breach scenario: HB-02 Credential abuse & account takeover

    Breach scenario Credential abuse & account takeover

  • SQ-ATO-023 steps · 30 days

    Leak to login

    A person's credentials appear in a public breach, a spike of malicious login attempts follows, and then a sign-in from an unusual context succeeds, all within 30 days.

    1. Step 1: Credential leaked (IA-T-01 Credentials leaked in a public breach)
    2. Step 2: Failed-login spike (IA-T-04 Targeted by malicious login attempts)
    3. Step 3: Unusual successful login (IA-B-04 Signs in from unusual contexts)
    4. Breach scenario: HB-02 Credential abuse & account takeover

    Breach scenario Credential abuse & account takeover

  • SQ-ATO-033 steps · 24 hours

    MFA fatigue

    Malicious login attempts trigger repeated MFA prompts, the person approves one at an odd hour, and a new factor is registered on the account, all within 24 hours.

    1. Step 1: Repeated MFA prompts (IA-T-04 Targeted by malicious login attempts)
    2. Step 2: Odd-hour approval (IA-B-05 Approves MFA after repeated prompts)
    3. Step 3: New factor registered (IA-B-05 Approves MFA after repeated prompts)
    4. Breach scenario: HB-02 Credential abuse & account takeover

    Breach scenario Credential abuse & account takeover

  • SQ-ATO-044 steps · 24 hours

    Help-desk takeover

    A caller pretexts the help desk by voice, an analyst with reset rights opens an MFA reset ticket, a new device is enrolled on the target account, and the account signs in with admin privileges, all within 24 hours.

    1. Step 1: Voice pretext (SE-T-04 Receives callback or voice phishing)
    2. Step 2: MFA reset ticket (SE-A-03 Can reset passwords or MFA for others)
    3. Step 3: New device (IA-B-05 Approves MFA after repeated prompts)
    4. Step 4: Admin login (IA-A-01 Holds admin or privileged roles)
    5. Breach scenario: HB-02 Credential abuse & account takeover

    Breach scenario Credential abuse & account takeover

  • SQ-RAN-015 steps · 7 days

    Click to execution

    The person clicks a real phishing link, lands on a known-malicious site, a suspicious process runs on their device, endpoint protection raises a credential-theft or lateral-movement alert, and EDR is tampered with, all within 7 days.

    1. Step 1: Real phish clicked (SE-B-04 Clicks links in real phishing)
    2. Step 2: Malicious site (WC-B-01 Visits known-malicious websites)
    3. Step 3: Suspicious process (EP-B-05 Runs suspicious processes or unapproved software)
    4. Step 4: Credential-theft alert (EP-T-04 Credential-theft, lateral-movement or privilege-escalation alert on their device)
    5. Step 5: EDR tampered (EP-B-01 Disables or tampers with EDR)
    6. Breach scenario: HB-03 Ransomware & malware intrusion

    Breach scenario Ransomware & malware intrusion

  • SQ-RAN-024 steps · 95 days

    Stealer to ransomware

    Infostealer indicators appear on a device the person uses, their credentials are flagged as compromised and offered for sale, a sign-in arrives from a new geography, and the account reaches a backup or storage console, all within 95 days.

    1. Step 1: Infostealer on device (EP-T-03 Infostealer indicators on a device they use)
    2. Step 2: Credentials for sale (IA-T-02 Credentials flagged as compromised)
    3. Step 3: Login from new geography (IA-B-04 Signs in from unusual contexts)
    4. Step 4: Backup console access (IA-A-04 Standing access to backup or storage consoles)
    5. Breach scenario: HB-03 Ransomware & malware intrusion

    Breach scenario Ransomware & malware intrusion

  • SQ-DL-013 steps · 30 days

    Quiet exit

    A person enters a notice period or role change, downloads data in bulk above their own baseline, and moves it to personal cloud storage or USB, all within 30 days.

    1. Step 1: Notice or role change (DH-A-02 In a notice period or role change)
    2. Step 2: Bulk download above baseline (DH-B-01 Downloads data in bulk above own baseline)
    3. Step 3: Personal cloud or USB (DH-B-08 Stores work data in personal cloud)
    4. Breach scenario: HB-07 Insider & privilege misuse

    Breach scenario Insider & privilege misuse

  • SQ-DL-023 steps · 30 days

    Shadow AI drift

    A person uses an unauthorized AI tool, signs into it with a personal account, and then puts sensitive data into a prompt, all within 30 days.

    1. Step 1: Unauthorized AI tool (AU-B-01 Uses unauthorized AI tools)
    2. Step 2: Personal account login (AU-B-03 Uses personal accounts on AI platforms)
    3. Step 3: Sensitive data in prompt (AU-B-02 Puts sensitive data in AI prompts)
    4. Breach scenario: HB-09 Shadow AI & agent misuse

    Breach scenario Shadow AI & agent misuse

  • SQ-FR-014 steps · 14 days

    Approver under attack

    An impersonation message reaches a person who holds payment approval authority, the person replies, a forwarding rule to an outside account appears on their mailbox, and a payee change is approved, all within 14 days.

    1. Step 1: Impersonation delivered (SE-T-03 Receives impersonation attempts)
    2. Step 2: Replied to sender (SE-B-09 Replies to or engages with suspicious senders)
    3. Step 3: Forwarding rule created (DH-B-06 Forwards work email to personal accounts)
    4. Step 4: Payee change approved (SE-A-02 Holds payment approval authority)
    5. Breach scenario: HB-05 BEC & payment fraud

    Breach scenario BEC & payment fraud

  • SQ-PRV-014 steps · 14 days

    Dormant to dangerous

    A person holds privileges unused for 90 or more days, signs in from an unusual context, gains membership of a privileged cloud group, and downloads data in bulk above their baseline, all within 14 days.

    1. Step 1: Unused privilege (IA-A-03 Privileges unused for 90+ days)
    2. Step 2: Unusual login (IA-B-04 Signs in from unusual contexts)
    3. Step 3: New cloud role (IA-A-02 Member of privileged security groups)
    4. Step 4: Bulk access (DH-B-01 Downloads data in bulk above own baseline)
    5. Breach scenario: HB-07 Insider & privilege misuse

    Breach scenario Insider & privilege misuse

  • SQ-OAUTH-014 steps · 90 days

    Consent to compromise

    A person grants a third-party app risky OAuth permissions, the vendor behind the app is breached, the app's token is used from an unusual context off-hours, and a bulk export follows, all within 90 days.

    1. Step 1: Risky consent granted (WC-B-04 Grants risky OAuth permissions)
    2. Step 2: Vendor breached (WC-T-02 Third-party app they use was breached)
    3. Step 3: Token used off-hours (IA-B-04 Signs in from unusual contexts)
    4. Step 4: Bulk export (DH-B-01 Downloads data in bulk above own baseline)
    5. Breach scenario: HB-08 Third-party, OAuth & supply chain

    Breach scenario Third-party, OAuth & supply chain

The six stages

Six stages.One person.

A sequence moves one person or AI agent through the stages as its steps happen. No step goes past Stage 4 Suspected; Stage 5 Confirmed needs the SOC to open an incident.

  1. Stage 0

    Clear

    The person has no active threat, access or risky-behavior signal inside any dwell window.

  2. Stage 1

    Exposed

    The person is targeted by a real threat, or holds access an attacker would want, and has shown no risky behavior yet.

  3. Stage 2

    Susceptible

    The person has shown risky behavior in a simulation or in hygiene telemetry, and no real threat has reached them yet.

  4. Stage 3

    Exploited

    The person acted on a real threat: a real click, a real consent, a real reply or a real credential submitted.

  5. Stage 4

    Suspected

    Signals point to a compromise of the person's account or device that the SOC has not yet confirmed.

  6. Stage 5

    Confirmed

    The SOC opened an incident and attributed it to the person; when it closes, the person returns to Stage 1 for a 90-day watch.

The initial assessment

Find your level.Then fix what matters.

18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.

Start the assessment Explore the taxonomy

Suggest a change

What kind of change?

Only if you would like a reply. See the privacy notice.

 Feedback
Start the assessment