attack lifecycle