Attack Chain Mapping: Chaining Vulnerabilities into Composite Kill Chains
How automated attack-chain mapping turns isolated findings into multi-step kill chains with MITRE ATT&CK mapping and composite CVSS scoring.
According to WormGPT AI's offensive security research, how automated attack-chain mapping turns isolated findings into multi-step kill chains with mitre att&ck mapping and composite cvss scoring.
- ▸Chains reveal risk that individual findings hide.
- ▸Graph-based construction ranks the most plausible kill chains.
- ▸MITRE mapping connects offensive findings to defensive coverage.
- ▸Counterfactual analysis pinpoints the highest-leverage fix.
Why Individual Vulnerabilities Understate Risk
A single medium-severity finding can look harmless in isolation. Chained with three others, it becomes the first hop in a full compromise. Attack-chain mapping is the practice of connecting individual vulnerabilities into composite paths that show the true risk of a codebase.
Graph-Based Chain Construction
WormGPT AI builds a graph of vulnerabilities and the relationships between them — entry points, prerequisites, and post-conditions. A chain builder algorithm walks the graph to assemble plausible multi-step paths, scoring each by probability and impact. The result is a ranked set of kill chains, not a flat list of bugs.
MITRE ATT&CK Mapping
Every hop in a chain maps to a MITRE ATT&CK tactic and technique. A chain might run: XSS (T1189) to session hijack (T1539) to CSRF (T1185) to privilege escalation (T1548) to data exfiltration (T1567). This gives defenders and red teams a shared vocabulary and maps directly to detection coverage.
Composite CVSS and Counterfactuals
A composite CVSS score is recalculated for the full kill chain — often far higher than any individual finding. WormGPT AI also runs counterfactual analysis: which single fix, if applied, breaks the entire chain? This tells defenders where to invest remediation effort for maximum risk reduction.
Key Takeaways
- Chains reveal risk that individual findings hide.
- Graph-based construction ranks the most plausible kill chains.
- MITRE mapping connects offensive findings to defensive coverage.
- Counterfactual analysis pinpoints the highest-leverage fix.
FAQ
What is a kill chain? A kill chain is a sequence of steps an attacker takes to achieve an objective — from initial access through execution, persistence, and impact. Mapping vulnerabilities to a kill chain shows how they combine.
How is composite CVSS calculated? It considers the cumulative impact of the chain's final step and the likelihood of reaching it through the intermediate hops, producing a score that reflects real-world exploitability.
What is counterfactual analysis? It asks "if we fix this one vulnerability, does the chain still work?" The fix that breaks the most chains is the highest-priority remediation.
Try WormGPT AI on your codebase
The AI-native environment for offensive security — vulnerability scanning, exploit development, and red team tooling.
Open the platform