Cyber Kill Chain

Overview

Developed by Lockheed Martin, the Cyber Kill Chain describes the 7 stages of a targeted cyberattack. Breaking any link in the chain stops the attack.

The 7 Stages

1. Reconnaissance

Attacker gathers information about the target.

Passive:  OSINT, LinkedIn, job postings, WHOIS, Google dorking
Active:   Port scanning, banner grabbing, DNS enumeration
Tools:    Shodan, Maltego, theHarvester, Recon-ng

2. Weaponization

Attacker creates a malicious payload (no target interaction yet).

Examples:
- Embedding malware in a PDF or Office document
- Creating a malicious macro
- Packaging an exploit with a backdoor (RAT)
Tools: Metasploit, msfvenom, custom scripts

3. Delivery

Weapon is transmitted to the target.

Vectors:
- Phishing email with malicious attachment
- Drive-by download via compromised website
- USB drop
- Watering hole attack
- Supply chain compromise

4. Exploitation

Malicious code executes on the target system.

Exploits:
- Software vulnerabilities (CVEs)
- Zero-day exploits
- Macro execution (user-triggered)
- Browser/plugin vulnerabilities

5. Installation

Attacker installs persistent access on the victim system.

Methods:
- Backdoor / RAT installation
- Web shell on a web server
- Scheduled tasks / cron jobs
- Registry run keys
- DLL hijacking

6. Command & Control (C2)

Compromised system communicates back to attacker.

Channels:
- HTTP/HTTPS beaconing
- DNS tunneling
- Social media C2
- Encrypted custom protocols
Tools: Cobalt Strike, Metasploit, Empire

7. Actions on Objectives

Attacker achieves their goal.

Goals:
- Data exfiltration
- Ransomware deployment
- Lateral movement
- Credential harvesting
- Sabotage / destruction

Kill Chain Defense Matrix

Kill Chain vs MITRE ATT&CK

ATT&CK is more granular — Kill Chain gives a high-level attack narrative.