Beyond the Linear Kill Chain: The 4X Cyber Attack Framework

Author: Aubrey Finn

"Adversaries rarely attempt to break 256-bit AES mathematically. They exploit the runtime operational boundary: why crack the vault when you can target unprivileged configuration files or memory artifacts in the user session?"

The Problem With Straight Lines

Early threat-modeling frameworks, most notably the Cyber Kill Chain, established an intuitive, linear path: an adversary breaches a perimeter, moves laterally step-by-step, and executes actions on objectives.

While this linear paradigm was pivotal for early network perimeter defense, modern endpoints host an entirely different threat reality. Automated payloads, living-off-the-land workflows, and in-host agents execute iteratively rather than sequentially.

Meanwhile, MITRE ATT&CK provides a comprehensive taxonomy of adversary techniques, but by design it does not prescribe execution order, transition logic, or dynamic loop progression.

To model how automated in-host tooling cycles through execution states, I synthesized the 4X Cyber Attack Framework (eXplore, eXpand, eXploit, eXfiltrate). Designed to complement ATT&CK's behavioral matrix, 4X functions as an operational state-machine heuristic.

Caption: The 4X Cyber Attack Framework: Modeling cyclical in-host adversary state transitions.

The 4X Operational State Machine

Adapted from classic strategic loops, 4X models adversary automation through distinct execution states and operational thresholds:

1. eXplore: Context & In-Process Reconnaissance

State Objective: Map execution context locally without triggering high-signal administrative or network alerts.

Mechanics: Querying environment variables, shell history, mounted shares, and process lists.

Transition Logic: If targeted client software or credential vaults are detected, transition to eXpand. If absent, branch to alternative discovery vectors (e.g., local token stores).

2. eXpand: Footprint & User-Space Staging

State Objective: Secure operational stability without administrative elevation.

Scope Boundary: Rather than relying on noisy UAC bypasses or kernel exploits, the adversary operates strictly within the privileges of the compromised user session.

Mechanics: Utilizing user-writable persistence paths (HKCU run keys, %APPDATA%) and querying process access handles with read permissions (PROCESS_VM_READ).

Transition Logic: Successful staging initiates eXploit. If access is restricted by policy, the agent loops back to eXplore for alternative vectors.

3. eXploit: Application Logic & Configuration Abuse

State Objective: Bypass cryptographic protections by exploiting application-level trust assumptions.

The "Vault Paradox": Symmetric encryption (AES-256) and memory-hard KDFs (Argon2) make brute-forcing cold vaults intractable. Instead, adversaries target the host environment:

Memory Artifacts: Illustrated by vulnerabilities like CVE-2023–32784 (affecting KeePass versions < 2.54), where unmanaged .NET string handling left master password fragments recoverable in memory dumps (excluding the first character).

Configuration Abuse: Illustrated by CVE-2023–24055, where pre-existing write access to user configuration files (KeePass.config.xml) allowed attackers to inject automated export triggers. (While vendors often dispute such behaviors as inherent to existing host compromise, they represent realistic operational vectors).

Transition Logic: Successful extraction transitions to eXfiltrate.

4. eXfiltrate: Low-Signal Outbound & State Reset

State Objective: Egress staging while minimizing anomaly detection.

Mechanics: Utilizing trusted application ports, legitimate HTTPS APIs, or webhooks, followed by temporary artifact cleanup.

Loop Reset: Once completed, the agent evaluates newly discovered interfaces or host boundaries, looping back to Phase 1 (eXplore) on adjacent systems.

Telemetry & Detection Engineering Matrix

4X Phase

Tactical Focus

MITRE ATT&CK Mapping

Detection Chokepoint (Sysmon / EDR)

Architectural Mitigation & Scope

eXplore

Context & Discovery

T1057 (Process Discovery) T1555 (Credentials from Stores)

Sysmon Event ID 10: ProcessAccess calls targeting sensitive binaries with read access masks.

Enforce process isolation; restrict unneeded debugging rights (SeDebugPrivilege).

eXpand

In-User Staging

T1055 (Process Injection) T1547.001 (Registry Run Keys)

Sysmon Event ID 13: Registry modifications under user-space run keys.

AppLocker / WDAC policies on user script execution. (Credential Guard protects LSASS, not generic vault processes).

eXploit

Logic Abuse

T1546 (Event Triggered Execution) T1559 (Inter-Process Comm)

Sysmon Event ID 11: FileCreate/Write events targeting application configuration files (*.xml, *.config).

Restrict ACLs on application configuration directories; enforce binary and configuration integrity.

eXfiltrate

Egress & Reset

T1041 (Exfiltration Over C2) T1070 (Indicator Removal)

Sysmon Event ID 3: Network connections from non-standard user binaries to untrusted destinations.

Strict egress firewall filtering and mandatory proxy inspection.

Controlled Validation & Telemetry Analysis

Testing this workflow in a controlled Windows 11 lab environment using Sysmon telemetry highlighted key detection insights:

Observation: Unprivileged scripts modifying application configuration files in %APPDATA% reliably trigger Sysmon Event ID 11 without administrative alerts.

False Positive Consideration: Normal application updates routinely modify local configuration XMLs. High-fidelity detections require correlating the parent process identityâ€"specifically alerting when administrative utilities, script hosts, or unexpected binaries touch configuration files.

Summary

Cryptographic strength does not offset an unmonitored runtime host environment. Modeling adversary behavior as a continuous eXplore \rightarrow eXpand \rightarrow eXploit \rightarrow eXfiltrate cycle provides enterprise security teams with a concrete method to identify weak configuration boundaries and correlate unprivileged user-space events before an adversary completes the loop.

The technical white paper, detection crosswalks, and formal documentation are available open-source on GitHub under CC BY 4.0.

GitHub - iskyfinn/4X-cyber-attack-framework: Technical specification and white paper for the 4X… Technical specification and white paper for the 4X Cyber Attack Framework: modeling agentic threat lifecycles, memory…

References and Foundational Research

References 1 — 8 support the technical discussion. References 9 — 12 provide additional conceptual background. Reference 13 identifies the author's framework and repository. Consult current product documentation before implementation.

1. MITRE. (2020). MITRE ATT&CK: Design and Philosophy. March 2020 revision.
2. . https://attack.mitre.org/docs/ATTACK_Design_and_Philosophy_March_2020.pdf
3. 2. Microsoft. Process Security and Access Rights. Microsoft Learn.
4. . https://learn.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights
5. 3. GitHub Advisory Database. CVE-2023–32784: KeePass master-password recovery from memory dumps in versions before 2.54.
6. . https://github.com/advisories/GHSA-f4c7-5p8v-p7jh
7. 4. National Institute of Standards and Technology. CVE-2023–24055. National Vulnerability Database. This record concerns configuration-based export abuse and includes the vendor's dispute.
8. . https://nvd.nist.gov/vuln/detail/CVE-2023-24055
9. 5. KeePass. Security Issues: Write Access to Configuration File. Vendor explanation of the security implications of configuration write access.
10. . https://keepass.info/help/kb/sec_issues.html
11. 6. KeePass. Enforced Configuration. Documentation for enforcing supported application settings.
12. . https://keepass.info/help/kb/config_enf.html
13. 7. Microsoft. How Credential Guard Works. Microsoft Learn. Describes Credential Guard architecture and its protection scope and limitations.
14. . https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/how-it-works
15. 8. Microsoft Sysinternals. Sysmon. Documentation for endpoint telemetry, including ProcessAccess (Event ID 10), FileCreate (Event ID 11), and RegistryEvent value changes (Event ID 13).
16. . https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon
17. 9. Emrich, A. (1993). MicroProse's Master of Orion: A Stealth Star Is Born. Computer Gaming World, issue 110, p. 92. Historical source for the strategy-game terminology "eXplore, eXpand, eXploit, eXterminate." This terminology provides a naming analogy; it does not establish a cybersecurity model.
18. . https://archive.org/details/Computer_Gaming_World_Issue_110
19. 10. Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation.
20. . https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf
21. 11. Boyd, J. R. (1996). The Essence of Winning and Losing. January 1996 briefing; September 2012 edition edited by Chet Richards and Chuck Spinney. Conceptual background for observation, orientation, decision, action, and feedback.
22. . https://ooda.de/media/john_boyd_-_the_essence_of_winning_and_losing.pdf
23. 12. MITRE. MITRE ATT&CK Enterprise Matrix. Maintained knowledge base of adversary tactics and techniques. Record the ATT&CK version used when documenting technique mappings.
24. . https://attack.mitre.org/matrices/enterprise/
25. 13. Finn, A. (2026). The 4X Cyber Attack Framework: Modeling Autonomous Adversary Loops. Technical white paper, Revision 1.1, October 13, 2026. Repository licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
26. . https://github.com/iskyfinn/4X-cyber-attack-framework

Revision Notes

Revision 1.1 preserves the eX naming convention: eXplore, eXpand, eXploit, and eXfiltrate. It positions 4X as complementary to MITRE ATT&CK, defines proposed state records and transitions, clarifies privilege and credential-protection boundaries, qualifies historical KeePass examples, and adds an illustrative validation design and supporting references.

The framework remains a conceptual proposal. No completed experiments, detection-performance measurements, or empirical validation results are reported.