What Is the Cyber Kill Chain?

The model breaks down cyberattacks into seven sequential stages, with each stage presenting a distinct opportunity for defenders to detect and respond:

• Reconnaissance: Attackers research their target, gathering information through passive means (e.g., public records, social media) or active means (e.g., network scanning) to identify vulnerabilities and potential entry points.
• Weaponization: The attacker creates or selects an exploit and pairs it with a payload (e.g., malware) to craft the attack tool.
• Delivery: The weaponized tool is transmitted to the target through methods such as phishing emails, malicious links, or infected USB drives.
• Exploitation: The weapon triggers, executing code on the victim’s system, often by leveraging software flaws or user actions like enabling macros.
• Installation: The attacker establishes persistence by installing components like backdoors or services that survive system reboots.
• Command and Control (C2): The compromised system establishes communication with the attacker’s infrastructure, allowing for remote interaction and command execution.
• Actions on Objectives: The attacker carries out their ultimate goal, which could involve data exfiltration, deploying ransomware, lateral movement across the network, or causing operational disruption.

The core principle is defense in depth: successfully interrupting the attack at any phase, from delivery to command and control, can prevent the final objective from being achieved.

Consider a ransomware attack scenario targeting a hospital:

1. Reconnaissance: Attackers gather hospital staff email addresses from the organization’s website.
2. Weaponization: They create an Excel file containing a malicious macro.
3. Delivery: This file is sent via email to billing staff, disguised as an “unpaid invoice.”
4. Exploitation: An employee opens the file and enables macros, allowing the malicious code to run.
5. Installation: A backdoor is installed, configured to launch automatically on system startup for persistent access.
6. Command and Control: The backdoor establishes a connection to the attacker’s server.
7. Actions on Objectives: The attackers then proceed to spread ransomware across the hospital’s file servers and encrypt data.

A defender implementing measures to block macro-enabled attachments at the email gateway could halt this attack during the Delivery stage, preventing any data encryption or further compromise.

The Cyber Kill Chain and the MITRE ATT&CK framework are complementary security models. The Kill Chain provides a high-level, chronological narrative of an attack, making it valuable for executive briefings and strategic understanding. In contrast, MITRE ATT&CK offers a granular catalog of adversary tactics and techniques, which is essential for detailed threat hunting, detection engineering, and operationalizing threat intelligence. Many threat intelligence platforms, including SOCRadar, align detected threats with both models to offer analysts the flexibility to zoom from a broad strategic view to specific technical behaviors.

While highly effective, the original Cyber Kill Chain model has limitations. It is primarily oriented towards traditional perimeter-based intrusions and malware delivery, which may not fully encompass newer attack vectors. Threats involving insider abuse, credential stuffing originating from stolen credentials, or purely cloud-native attacks without traditional malware may not map perfectly to its seven stages. This has led to the development of expanded ‘unified kill chain’ models and the widespread adoption of frameworks like MITRE ATT&CK. However, the seven-stage Cyber Kill Chain remains a valuable educational tool and a clear conceptual framework for understanding layered defense strategies against common cyber threats.

An analogy for the Cyber Kill Chain’s defensive principle is a burglary. Stages might include casing the house, acquiring tools, picking a lock, entering, hiding, providing access for accomplices, and removing valuables. By implementing security measures such as locks, cameras, or alarms at any of these stages, a homeowner can prevent the entire burglary, illustrating the concept that successfully defending against an attack requires only winning at one point.

Who created the Cyber Kill Chain? Lockheed Martin introduced it in 2011, adapting a military targeting concept to cyber defense.

How many stages are in the Cyber Kill Chain? Seven: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives.

Can you stop an attack in the middle of the chain? Yes. Because the stages are ordered, breaking any single link disrupts the entire attack, which is the model’s core defensive value.