Kill Chain Stage Identifier

The Cyber Kill Chain is Lockheed Martin's seven-stage description of how a targeted attack actually unfolds, and its value is that it turns a break-in into a sequence you can interrupt. The stages are Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives, in that order. Sorting an action into the right one is not about the tool involved — a Word document shows up in three different stages here — but about what the attacker has accomplished at that moment. Reconnaissance is everything that happens before the attacker touches anything of yours in anger. Scraping LinkedIn for names and job titles and sweeping a public IP range with Shodan are both intel gathering; nothing has been built and nothing has been sent. Weaponization is the workshop stage, and it happens entirely on the attacker's own machine: bundling a keylogger into a macro document, or building a PDF that targets an unpatched Adobe Reader flaw. The weapon exists but the victim has never seen it. Delivery is the moment it crosses the gap — the spear phishing email lands in the CFO's inbox, the infected USB drive is dropped in the parking lot. Note that delivery is about transmission, not success: the USB in the parking lot is delivered even if nobody ever picks it up. The boundary students most often blur is Weaponization against Delivery against Exploitation, and the same Word document sits on both sides of it. Bundling the keylogger into the macro is Weaponization. Emailing that document to the CFO is Delivery. The macro actually running when the victim opens the file is Exploitation — the point where attacker-supplied code executes on victim hardware for the first time. The zero-day triggered by a crafted packet against the VPN client is the same event without a human in the loop. Exploitation is a moment, not a state; it is the door opening. Installation is what makes the access survive the door closing again. A RAT writing itself into the Startup folder, or malware registering a scheduled task that relaunches it when killed, are both about persistence: the attacker wants to still be there after a reboot or a terminated process. Command and Control is the conversation that follows — the compromised host beaconing out every sixty seconds for instructions, or tunneling that traffic through a CDN by domain fronting so it looks like ordinary web requests. C2 is not the damage; it is the remote hand on the controls. Actions on Objectives is the damage, and the only stage that describes why any of the rest happened: exfiltrating the customer database to an external FTP server, or encrypting every file and posting a ransom demand. Two very different goals, one stage, because the stage is defined by the attacker finally getting what they came for. The reason this model is worth memorizing is the dependency. Every stage needs the one before it, so a defender does not have to win seven times — they have to win once. Security awareness training attacks Delivery. Patching attacks Exploitation. Application allowlisting attacks Installation. Egress filtering and DNS monitoring attack C2. Data loss prevention attacks Actions on Objectives. Break any single link and the stages after it never happen, which is why incident responders ask which stage an alert belongs to before they ask anything else: it tells them how far in the attacker already is, and which links are still theirs to cut.