4.1.1. The Cyber Kill Chain
💡 First Principle: The Kill Chain model describes intrusions as a sequence of stages that each require attacker success — defenders who interrupt any stage prevent the attacker from achieving their objective, which means you don't have to stop the first step to win.
Developed by Lockheed Martin, the Cyber Kill Chain models targeted intrusions as seven sequential stages. The "chain" analogy is deliberate: break any link and the attacker's campaign fails. This is why defense-in-depth matters — if phishing prevention fails (Stage 3), host-based execution prevention (Stage 5) is another opportunity to intervene.
| Stage | Attacker Activity | Defensive Opportunity |
|---|---|---|
| 1. Reconnaissance | OSINT research, scanning, identifying targets | Minimize public footprint; monitor for scanning; honeypots |
| 2. Weaponization | Creating malware, exploit payloads, phishing lures | Threat intel on new malware families; sandboxing of email attachments |
| 3. Delivery | Sending phishing email, drive-by download, USB drop | Email filtering, web proxy, user training, USB controls |
| 4. Exploitation | Executing the exploit against a vulnerability | Patching, EDR behavioral detection, exploit mitigations (ASLR, DEP) |
| 5. Installation | Establishing persistence (malware install, scheduled task) | EDR, application whitelisting, monitoring registry/scheduled tasks |
| 6. Command & Control | Attacker establishes comms channel to compromised system | C2 detection via SIEM, DNS monitoring, SSL inspection, threat intel feeds |
| 7. Actions on Objectives | Data theft, ransomware, lateral movement, destruction | DLP, privileged access controls, network segmentation, anomaly detection |
Using the Kill Chain for gap analysis: Map your current controls to each stage. Stages with no defensive controls are gaps — the attacker can proceed through those stages unimpeded. Stages with multiple redundant controls are resilient — the attacker must defeat several independent defenses.
Kill Chain limitation: The linear model doesn't fully capture modern attack patterns where attackers loop between stages (e.g., moving back to reconnaissance after gaining initial access) or conduct multiple simultaneous campaigns. MITRE ATT&CK addresses this with a non-linear, more granular structure.
⚠️ Exam Trap: The Kill Chain stages apply to the attacker's perspective. "Actions on Objectives" doesn't mean the same thing for every attacker — ransomware actors encrypt files; espionage actors exfiltrate data; destructive actors wipe systems. The final stage's meaning depends on threat actor motivation.
The Courses of Action Matrix
Lockheed Martin's original Kill Chain paper pairs each phase with six defensive actions taken from military information operations doctrine: detect, deny, disrupt, degrade, deceive, and destroy. Filling in the matrix shows which phases you can act on and which you cannot.
| Phase | Example control | Action |
|---|---|---|
| Delivery | Proxy filter blocks the lure's URL | Deny |
| Delivery | Mail queuing slows delivery | Degrade |
| Exploitation | Patching removes the vulnerability | Deny |
| Exploitation | Data execution prevention (DEP) stops a running exploit | Disrupt |
| Command & Control | DNS redirect sends beacons to a defender-controlled host | Deceive |
Deny means the step cannot succeed at all. Disrupt means it starts and is then interrupted. Knowing the difference tells you whether a control prevents a phase or only limits it.
Campaign analysis. A new exploit is only one change in a multi-phase process. Attackers who reuse a lure builder, sending infrastructure, or C2 across campaigns can be stopped by indicators from earlier intrusions even when the exploit itself has never been seen. This is why analysts record indicators from every phase, not just the exploit.
⚠️ Exam Trap: Actions on Objectives is not only data theft. Lockheed Martin's definition includes integrity and availability goals, and it also covers an intruder who wants the first compromised host only as a hop point to reach other systems.
Reflection Question: An organization has strong email filtering (stops 95% of phishing), EDR on all endpoints, and a well-tuned SIEM. A threat intelligence report indicates an APT group is now using USB drops (malicious USB drives left in parking lots) as their primary delivery method. Which Kill Chain stage does this bypass, and which remaining defenses are still relevant?
