What Comes Next in the Chain?

About this interactive

What you'll learn

• Read a defender's timeline of observations and name the Cyber Kill Chain phase the attack has reached
• Predict the phase that comes next if nothing breaks the chain, so the defense can be placed ahead of the attacker

Aligned to

Key terms

Cyber Kill Chain

The Cyber Kill Chain is a Lockheed Martin threat model describing the seven stages of a targeted cyberattack — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives — used to structure defensive strategies.

Reconnaissance

The first phase of an attack in which an adversary gathers information about a target — such as open ports, employee names, and technology stacks — before launching an attack. Reconnaissance can be passive (using public sources) or active (directly probing the target).

Weaponization

The phase of the cyber kill chain where an attacker creates, obtains, or modifies malware and other tools necessary to carry out an attack.

Command and Control

C2

The infrastructure and communication channels attackers use to issue instructions to compromised systems and receive data from them, enabling persistent access and coordinated attack operations.

Beaconing

A pattern of regular, repeated outbound network communications from a compromised host to an attacker's command-and-control server.

Endpoint Detection and Response

EDR

A security solution that continuously monitors endpoint devices to detect, investigate, and respond to threats.

Security Operations Center

SOC

A centralized team and facility responsible for monitoring, detecting, and responding to security incidents.

Topics

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.