TechKnowSurge

VideoSecurityFree

Cyber Kill Chain

The Cyber Kill Chain is a framework developed by Lockheed Martin that models the sequential stages an adversary follows when planning and executing an attack against an organization. Understanding each phase helps security professionals anticipate attacker behavior and identify opportunities to detect or disrupt an intrusion.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The Cyber Kill Chain is a security framework developed by Lockheed Martin, originally to protect its own infrastructure, and later released for broader industry use. Rooted in military analysis methodology — where understanding an adversary's step-by-step process enables more effective countermeasures — the framework maps the phases an attacker typically moves through from initial planning to achieving their final objective. Those phases are reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives, and each represents both a stage in the attack and a potential intervention point for defenders. Reconnaissance involves gathering intelligence on the target organization, including its personnel, infrastructure, email formats, partners, and publicly available technical details such as IP addresses and domains. Weaponization follows, where the adversary acquires or develops the tools needed for the attack — commonly malware such as ransomware. Delivery is the mechanism used to get that payload to a victim, whether through a phishing email, a dropped USB drive, or another vector. Exploitation occurs when the victim interacts with the payload and the attacker gains initial access, while the installation phase focuses on establishing persistence so that access is maintained even if the initial malware is removed. Command and control gives the adversary remote authority over a compromised system, enabling further reconnaissance and lateral movement across the network. Finally, actions on objectives represent the attacker's end goal — data exfiltration, disruption, financial theft, or another targeted outcome. The Cyber Kill Chain is often compared to the MITRE ATT&CK framework, and while there is meaningful overlap in terminology and concepts, the two serve distinct purposes. MITRE ATT&CK functions as a comprehensive, searchable database of adversary tactics and techniques, while the Cyber Kill Chain is better suited for analyzing the overall arc and progression of a specific attack. Notably, MITRE ATT&CK includes concepts such as privilege escalation, defense evasion, credential access, lateral movement, and collection that the Kill Chain does not address as discrete stages, though many of those behaviors are implied across its phases. In practice, an attack does not always follow the Kill Chain in strict linear order — defenders and analysts should expect attackers to revisit earlier stages, take parallel paths, or adapt dynamically as they move through a target environment.

What you'll learn

Identify the sequential phases of the Cyber Kill Chain and describe the adversary actions associated with each phase
Distinguish between the Cyber Kill Chain framework and the MITRE ATT&CK framework in terms of purpose and structure

What's covered

Cyber Kill Chain

Origin & Purpose
- Military term adapted
- Lockheed Martin created
- Analyze adversary approach
Kill Chain Phases
- Reconnaissance
  - Organization info gathering
  - Personal identifiers & social media
  - IP addresses & domains
- Weaponization
  - Malware & tools prep
- Delivery
  - Email, USB, file drops
- Exploitation & Installation
  - Exploit vulnerability for access
  - Install persistence on network
- Command & Control
  - Adversary takes over system
  - Internal network reconnaissance
- Action on Objectives
  - Data exfiltration
  - Disruption or financial gain
Cyber Kill Chain vs MITRE ATT&CK
- Kill chain analyzes approach
- MITRE ATT&CK is a database
- MITRE includes discovery & collection
- Phases can overlap or branch

Key terms

Cyber Kill Chain: The Cyber Kill Chain is a Lockheed Martin threat model describing the seven stages of a targeted cyberattack — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives — used to structure defensive strategies.
Reconnaissance: The first phase of an attack in which an adversary gathers information about a target — such as open ports, employee names, and technology stacks — before launching an attack. Reconnaissance can be passive (using public sources) or active (directly probing the target).
Exploit: A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Malware: Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.
Privilege Escalation: An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.
Threat Actor: An individual or group responsible for a security incident or attack.
MITRE ATT&CK: A globally accessible knowledge base that categorizes adversary tactics and techniques based on real-world observations, used to understand and defend against cyber threats.
Persistence: A MITRE ATT&CK tactic in which an adversary maintains their foothold within a compromised network to survive restarts, credential changes, or other interruptions.

Topics

Cyber Kill Chain Threat Intelligence Adversary Tactics Intrusion Detection Mitre Attck Cybersecurity Incident Response

Transcript

The cyber kill chain is a process that many adversaries are going to go through in attacking an organization and carrying out some sort of action on objectives.

Where the term comes from

The term kill chain has been around for a while. Kill chain is actually a military term, and what they would do is analyze the enemy movement, the step-by-step processes that they would go through to carry out an attack. By analyzing the kill chain, they'd better understand the adversary and how to counter the adversaries. Now we've taken some of that concept and applied it to the cyber world and these cyber adversaries. That's where the term cyber kill chain comes into place, and essentially it's a chain of events that an adversary will take in order to hack a network and carry out their action on objectives.

A lot of times you'll see compare and contrast between the cyber kill chain and MITRE ATT&CK. There are some similarities; like I say, the tactics between the two sometimes are named the same, and sometimes they have a very similar meaning or a very similar process. But I do view them as a little different. I view the cyber kill chain as something to analyze what the adversary is doing, versus MITRE ATT&CK as more of a database. Although you could use both for the same effect of analyzing what an attacker will do and their approaches to things.

I've come to the Lockheed Martin website, and that's because they are the ones that came up with the cyber kill chain. It's what they use to identify threats to Lockheed Martin, but they've made this public knowledge so that we could utilize this same concept when we're analyzing our own organizations.

Reconnaissance

The first step is the reconnaissance phase. An adversary is going to want to find out as much information about their target as they can. So they're going to look for working hours, policies, the leadership team, email formats, partners, dumpster diving. They're also going to take a look at specific people within the organization: personal identifiers such as email and phone numbers, contextual information such as their hobbies and interests, and some sources. They'll take a look at websites, social media, and conferences, just trying to find any information they can on both the people within the organization and the organization itself, and any information around IP addresses, servers, industrial control systems they might have, and domains that they own. Much of this is public information.

From there, they're going to develop a plan on how to launch an attack against the organization.

Weaponization

They're also going to start researching, or weaponizing. Weaponizing is the idea that they're going to start taking a look at what they can equip themselves with. Maybe it's skill, maybe it's knowledge, maybe it's some sort of access credentials, maybe it's programs, maybe it's viruses and malware, but they're going to equip themselves to carry out their attack. So in this case, they're weaponizing themselves.

Delivery

Now, weaponization largely has to do with malware. Many times malware is used during an attack, and so somehow they need to deliver that malware. Maybe they have some ransomware and they need to deliver this ransomware. So there's the delivery phase. Inside the delivery phase, what they're going to do is put it inside of a file. Maybe they put it on a USB drive and drop it in a parking lot. Maybe they deliver it by other means; maybe it's email. They're going to somehow get this virus to somebody inside of the company, so that that person can click on it and then it will infect their computer.

Exploitation and installation

Once it's been delivered to the victim, somehow that victim is going to need to be tricked into executing it. This is the exploitation phase. This is when the virus or the malware or whatever it is gets installed onto the computer.

Now, in my mind, the installation phase and the exploitation phase have a lot of overlap and are a little less clear than some of these other phases here. The installation phase is the idea that you're going to install some sort of persistence on the network, some sort of persistence maybe on the machine or somewhere else on the network. When it comes to exploitation, you're exploiting a vulnerability. That might be malware being installed on a machine, but it's the idea that you're exploiting to gain initial access into the systems, versus this installation might be some sort of persistence, trying to gain persistence on the network.

Let me give you an example. A common attack is that the initial malware is just to gain initial access into the system, and then once you have initial access on the system that malware may go away. So to gain persistence, there might be some additional installs of software, or maybe other types of access gaining that persistence on the network.

Command and control

Once an adversary has exploited the system and installed some sort of persistence, at that point in time they're going to want to start scanning the rest of the network and start exploring the rest of the network. But in order to do that, there needs to be some sort of command and control. The command and control allows the adversary to take over a system and do what they want with that system. In this case right here, my example is that they'll start controlling this machine to start doing reconnaissance on the rest of the network.

Actions on objectives

The final step is that they're trying to reach some sort of objective. Maybe it's some sort of financial objective, or causing disruption, or data exfiltration. So they're going to take action on that. Maybe they're controlling the system, and now they've identified a file server and identified some information that they want to steal. So now they're going to go through the process of data exfiltration. That is the action: they're taking action on the objective, and the objective is stealing that data.

Comparing the two models

Let's talk about a couple of the discrepancies between the two models, because for the most part the two models do line up. But we see here there's privilege escalation, defense evasion, credential access, lateral movement. And then also we have discovery, and there's no discovery on the cyber kill chain. We've got collection, which is also not on the cyber kill chain. I view the discovery and collection phases of this as just being more about reconnaissance. And we see things like privilege escalation and defense evasion, which are kind of a combination of some of these as well.

So within the cyber kill chain, you kind of step through this process, but you might actually take multiple paths. There might be branches, and you might step back into the reconnaissance phase again and do reconnaissance as you're discovering things on the network. So you're jumping around a little bit with the cyber kill chain. You may actually do that with MITRE ATT&CK as well. But this is the reason why the cyber kill chain is great for analyzing the approach that an adversary is going to take, versus MITRE ATT&CK being really, like I say, more of a database of all of these tactics and techniques.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →