4.1.1. The Cyber Kill Chain
💡 First Principle: The Kill Chain model describes intrusions as a sequence of stages that each require attacker success — defenders who interrupt any stage prevent the attacker from achieving their objective, which means you don't have to stop the first step to win.
Developed by Lockheed Martin, the Cyber Kill Chain models targeted intrusions as seven sequential stages. The "chain" analogy is deliberate: break any link and the attacker's campaign fails. This is why defense-in-depth matters — if phishing prevention fails (Stage 3), host-based execution prevention (Stage 5) is another opportunity to intervene.
| Stage | Attacker Activity | Defensive Opportunity |
|---|---|---|
| 1. Reconnaissance | OSINT research, scanning, identifying targets | Minimize public footprint; monitor for scanning; honeypots |
| 2. Weaponization | Creating malware, exploit payloads, phishing lures | Threat intel on new malware families; sandboxing of email attachments |
| 3. Delivery | Sending phishing email, drive-by download, USB drop | Email filtering, web proxy, user training, USB controls |
| 4. Exploitation | Executing the exploit against a vulnerability | Patching, EDR behavioral detection, exploit mitigations (ASLR, DEP) |
| 5. Installation | Establishing persistence (malware install, scheduled task) | EDR, application whitelisting, monitoring registry/scheduled tasks |
| 6. Command & Control | Attacker establishes comms channel to compromised system | C2 detection via SIEM, DNS monitoring, SSL inspection, threat intel feeds |
| 7. Actions on Objectives | Data theft, ransomware, lateral movement, destruction | DLP, privileged access controls, network segmentation, anomaly detection |
Using the Kill Chain for gap analysis: Map your current controls to each stage. Stages with no defensive controls are gaps — the attacker can proceed through those stages unimpeded. Stages with multiple redundant controls are resilient — the attacker must defeat several independent defenses.
Kill Chain limitation: The linear model doesn't fully capture modern attack patterns where attackers loop between stages (e.g., moving back to reconnaissance after gaining initial access) or conduct multiple simultaneous campaigns. MITRE ATT&CK addresses this with a non-linear, more granular structure.
⚠️ Exam Trap: The Kill Chain stages apply to the attacker's perspective. "Actions on Objectives" doesn't mean the same thing for every attacker — ransomware actors encrypt files; espionage actors exfiltrate data; destructive actors wipe systems. The final stage's meaning depends on threat actor motivation.
Reflection Question: An organization has strong email filtering (stops 95% of phishing), EDR on all endpoints, and a well-tuned SIEM. A threat intelligence report indicates an APT group is now using USB drops (malicious USB drives left in parking lots) as their primary delivery method. Which Kill Chain stage does this bypass, and which remaining defenses are still relevant?
