Today I learned about the Cyber Kill Chain, a framework developed to help cyber professionals understand how adversaries plan and execute attacks. Rather than viewing an attack as a single event, the kill chain breaks it down into distinct stages, making it easier for defenders to detect and disrupt malicious activity.
What the Cyber Kill Chain is
The Cyber Kill Chain is a model that describes the lifecycle of a cyberattack from the attacker’s perspective. By understanding each stage, defenders can identify where an attack may be occurring and apply controls to stop it before the attacker reaches their objective.
Reconnaissance
Reconnaissance is the first stage of the kill chain. During this phase, attackers gather information about their target. This may include identifying technologies in use, employees, exposed services, or potential entry points.
Reconnaissance can be:
- Passive – collecting information without directly interacting with the target, such as through OSINT
- Active – directly probing the target, such as scanning systems or interacting with services
Weaponization
In the weaponization stage, attackers decide which tools or malware they will use. This may involve modifying existing malware, developing custom payloads, or sourcing tools from underground communities.
The goal is to prepare a payload that fits the target environment and increases the chance of a successful compromise.
Delivery
Delivery is the method used to get the malicious payload to the victim. Common delivery mechanisms include phishing emails, malicious attachments, compromised websites, or infected USB devices.
This stage is often where user awareness and technical controls play a critical defensive role.
Exploitation
Once the payload reaches the target system, the attacker attempts exploitation. This involves executing the payload by taking advantage of vulnerabilities on the system.
Exploitation may rely on:
- Unpatched known vulnerabilities (CVEs)
- Misconfigurations
- Zero-day vulnerabilities
Successful exploitation allows the attacker to execute malicious code on the system.
Installation
After exploitation, attackers move to installation. At this stage, they install malicious software or backdoors to maintain persistence on the compromised system.
This ensures the attacker can regain access even after reboots or basic remediation attempts.
Command and Control
Once persistence is established, the attacker creates a command and control (C2) channel. This connection allows the attacker to remotely control the infected system, often resembling a reverse shell.
Through C2, attackers can issue commands, move laterally, and prepare for further actions.
Actions on objectives
The final stage is where attackers achieve their goal. This may involve data exfiltration, credential harvesting, deleting backups, or using the compromised system as a stepping stone to target more valuable assets.
At this point, the impact to the organization is usually most visible.
Key takeaway
The Cyber Kill Chain highlights that attacks are processes, not isolated events. Each stage presents an opportunity for detection and defense. For SOC analysts, understanding this lifecycle helps in identifying where an attack may be occurring and how to disrupt it before serious damage is done.
No comments yet.