COMP3143›Cyber kill chain

Cyber SecurityTopic 14 of 21

Cyber kill chain

2 minread

361words

Beginnerlevel

Cyber Kill Chain

The Cyber Kill Chain is a model developed by Lockheed Martin to describe the stages of a cyber attack. It helps organizations understand, detect, and defend against attacks by analyzing how attackers operate.

Purpose of the Cyber Kill Chain

Provides a structured view of the attack lifecycle.
Helps identify attacks early in the chain to prevent damage.
Assists in designing defense strategies at each stage.

The 7 Stages of the Cyber Kill Chain

Stage	Description	Example / Technique
1. Reconnaissance	Attacker gathers information about the target.	Scanning networks, searching social media, WHOIS lookup
2. Weaponization	Attacker creates a malicious payload tailored to the target.	Malware, exploit kits, phishing email attachments
3. Delivery	The weapon is transmitted to the target.	Email phishing, drive-by download, USB drop
4. Exploitation	Exploit is triggered to gain access.	Exploiting software vulnerabilities, macros in documents
5. Installation	Malware or backdoor is installed on the target system.	Trojans, rootkits, Remote Access Trojans (RATs)
6. Command and Control (C2)	Attacker establishes a communication channel to control the system.	Using C2 servers to send commands and receive stolen data
7. Actions on Objectives	Attacker achieves their goal.	Data theft, ransomware encryption, sabotage, espionage

How the Cyber Kill Chain Helps Defense

Detection – Identify threats at each stage (e.g., abnormal network traffic for C2).
Prevention – Block stages like delivery or exploitation using firewalls, patching, or email filters.
Incident Response – Helps teams respond systematically by knowing which stage is active.
Threat Intelligence – Understanding attacker techniques improves future defenses.

Defense Strategies at Each Stage

Stage	Defense Measures
Reconnaissance	Hide sensitive info, limit public exposure, use honeypots
Weaponization	Threat intelligence to identify malware patterns
Delivery	Email filtering, anti-malware, content inspection
Exploitation	Patch management, endpoint security, vulnerability scanning
Installation	Application whitelisting, intrusion prevention systems
Command & Control	Network monitoring, firewall rules, anomaly detection
Actions on Objectives	Data encryption, access controls, backups

Summary

The Cyber Kill Chain is a step-by-step model of a cyber attack: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. By understanding each stage, organizations can detect threats early, implement preventative measures, and respond effectively to attacks.

Previous topic 13

Database security

Next topic 15

Privacy and anonymity

Past Papers

Open this section to load past papers

Click on Show Past Papers to see past papers.

The 7 Stages of the Cyber Kill Chain

Stage

Description

Example / Technique

1. Reconnaissance

Attacker gathers information about the target.

Scanning networks, searching social media, WHOIS lookup

2. Weaponization

Attacker creates a malicious payload tailored to the target.

Malware, exploit kits, phishing email attachments

3. Delivery

The weapon is transmitted to the target.

Email phishing, drive-by download, USB drop

4. Exploitation

Exploit is triggered to gain access.

Exploiting software vulnerabilities, macros in documents

5. Installation

Malware or backdoor is installed on the target system.

Trojans, rootkits, Remote Access Trojans (RATs)

6. Command and Control (C2)

Attacker establishes a communication channel to control the system.

Using C2 servers to send commands and receive stolen data

7. Actions on Objectives

Attacker achieves their goal.

Data theft, ransomware encryption, sabotage, espionage

How the Cyber Kill Chain Helps Defense

Detection – Identify threats at each stage (e.g., abnormal network traffic for C2).

Prevention – Block stages like delivery or exploitation using firewalls, patching, or email filters.

Incident Response – Helps teams respond systematically by knowing which stage is active.

Threat Intelligence – Understanding attacker techniques improves future defenses.

Defense Strategies at Each Stage

Stage

Defense Measures

Reconnaissance

Hide sensitive info, limit public exposure, use honeypots

Weaponization

Threat intelligence to identify malware patterns

Delivery

Email filtering, anti-malware, content inspection

Exploitation

Patch management, endpoint security, vulnerability scanning

Installation

Application whitelisting, intrusion prevention systems

Command & Control

Network monitoring, firewall rules, anomaly detection

Actions on Objectives

Data encryption, access controls, backups

Summary