How to Map Attack Chains in WormGPT AI

Why Chains Beat Lists

A medium-severity information disclosure, a medium-severity IDOR and a medium-severity deserialization bug look unremarkable on a spreadsheet. Chained, they are account takeover: enumerate users, swap an identifier, then reach a sink that trusts the identifier's owner.

Severity scores describe bugs in isolation. Attack chains describe what an intruder can actually do. Reviewers, executives and defenders all act more decisively on the second.

Step 1: Finish Discovery Before Chaining

Chaining rewards coverage. Run discovery across the scope first, confirm findings, and only then look for junctions. Chaining partial results produces fiction: a chain that assumes a bug you have not confirmed is a story, not a finding.

Step 2: Look for the Junctions

Chains form where one finding produces a capability another finding consumes. The common junction types:

• Information to access. Disclosure or enumeration feeds an IDOR, a password reset or an authorisation bypass.
• Access to execution. Session fixation, token reuse or privilege escalation feeds a deserialization sink.
• Execution to persistence. Command injection or file upload feeds a scheduled task, service install or startup modification.
• Execution to exfiltration. Execution plus a reachable egress path plus data access.

Ask of every confirmed finding: what does this give the attacker? Then: which other finding needs exactly that?

Step 3: Sequence and Prerequisites

An attack chain is an ordered list, not a set. Write it that way, with prerequisites per step: authentication level, network position, timing window, required configuration. A chain requiring three preconditions and a maintenance window is a different business risk from a two-step chain anyone can run with a browser.

Step 4: Map to ATT&CK

Map each step to a MITRE ATT&CK technique. The mapping does two jobs: it gives defenders something to hunt for (the technique IDs and their telemetry), and it shows where detection would break the chain. Most chains have one step with genuinely good telemetry — find it, and that is your recommended control.

Step 5: Score the Chain, Not the Bugs

Score the chain end to end. What an intruder reaches at the end determines severity, not the individual CVSS of the middle steps. Report both: per-finding scores for remediation tracking, chain score for decision-making.

Then prioritise fixes by how much of the chain they cut. A single fix that removes the junction — validating ownership on that one endpoint — can dissolve a five-step chain.

Step 6: Write the Narrative

Structure the write-up as a story with evidence at each step:

1. Objective (what the chain reaches).
2. Preconditions.
3. Steps, each with the finding, the payload, and the observable result.
4. ATT&CK tactics and techniques.
5. The single highest-leverage fix.

Six months later that document is what the defender reads when they ask "how would this have happened?"

Key Takeaways

• Complete and confirm discovery before chaining; chains built on unconfirmed bugs are fiction.
• Chains form at junctions: information to access, access to execution, execution to persistence and exfiltration.
• Record prerequisites per step — they change the real-world risk more than the payload does.
• Map steps to ATT&CK to identify the one control that breaks the chain.
• Prioritise remediation by how much chain a fix removes, not by individual CVSS alone.

FAQ

Does WormGPT AI build the chain automatically? It proposes chains from findings and their junctions, and maps them to ATT&CK. You still validate prerequisites and confirm each step holds in the target environment.

How many steps should a chain have? Real chains are usually two to five steps. Long chains impress in fiction and break in practice.

What if a step is only theoretical? Report it as a conditional step, clearly marked. Conditional chains are still useful for remediation planning, but do not present them as demonstrated.

How does chaining change remediation order? It often reorders it sharply: fixing the junction step frequently removes more risk than fixing the highest-scored individual bug.