Seven phases from reconnaissance through weaponization, delivery, exploitation, installation, command and control, and actions on objectives.
Use
A first sequencing frame when you need to know what stage you are looking at.
Limit
Assumes a linear, malware-delivered, perimeter intrusion. It handles insiders, stolen credentials, and web-application attacks poorly.