Cyber Kill Chain

A model that describes 7 sequential stages an attacker follows to achieve their objectives.

Each stage provides a point where defenders can detect, disrupt, or mitigate the attack. Ideally this is done in the earliest possible stage.

It was developed by Lockheed Martin, and is used for threat detection and mitigation.

Stages

1. Reconnaissance: gather information on the target. Can be done with:
   • Active recon: locate open ports and the services they run, map network etc.
   • Passive recon: gather info from web sources, e.g. job ads, company website, or social media.
2. Weaponize: develop malware for initial access and prepare it as an exploit or payload.
3. Delivery: deliver payload or perform exploit on the victim(s).
4. Exploitation: the payload or exploit is triggered
5. Installation: the attacker deploys mechanism for persistent access to the system, e.g. Dropper, Backdoor, or Rootkit.
6. Command & Control (C2): the attacker establishes remote access to the compromised system.
7. Actions: the attacker performs the objective of the attack, e.g. extract data, deploy ransomware etc.