Cyber Kill Chain

A Cyber Kill Chain is a framework that describes the sequential stages attackers follow to execute a successful cyberattack.

Originally developed by Lockheed Martin, this model breaks down cyberattacks into seven distinct phases: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives.

The framework begins with reconnaissance, where attackers gather intelligence about their target, followed by weaponization, where they create malicious payloads. The delivery phase involves transmitting the weapon to the target, while exploitation takes advantage of vulnerabilities to execute code. Installation establishes a persistent foothold, command and control creates communication channels, and finally, actions on objectives accomplish the attacker's ultimate goals.

Understanding the Cyber Kill Chain helps security professionals identify where attacks can be detected and stopped. By implementing defenses at multiple stages rather than relying on perimeter security alone, organizations can create a layered defense strategy. For example, email filtering can stop attacks during delivery, endpoint detection can catch exploitation attempts, and network monitoring can identify command and control communications. This model emphasizes that breaking the chain at any point can prevent successful attacks, making it a valuable tool for both defensive planning and incident analysis.