An intelligence-driven defense framework: the attacker's path from recon to objective, and where you break it.
Last updated
Free, no signup · 1 page · 21 scenarios · 210 KB
Work backwards from what happened. The boundary cases are where marks are lost, so each row says why it lands where it does.
| What happened | Phase | Why |
|---|---|---|
| Scraping employee names and job titles from LinkedIn | Reconnaissance | Nothing has been sent or built yet. Gathering target information is always phase 1. |
| Embedding a macro payload into a Word document | Weaponization | The weapon is being assembled offline, on the attacker side. Nothing has touched the target. |
| Dropping malicious USB drives in the car park | Delivery | Delivery is the moment the payload is transmitted toward the target, whatever the medium. |
| Sending a spear-phishing email with a malicious link | Delivery | The email is the transport. It becomes Exploitation only once the victim acts on it. |
| A compromised website triggers a browser vulnerability | Exploitation | Code is now executing on the victim machine. That is the line between Delivery and Exploitation. |
| The victim opens the attachment and the macro runs | Exploitation | Same rule: the payload has executed. The email that carried it was Delivery. |
| Malware creates a scheduled task so it survives reboot | Installation | Persistence is the signature of Installation. Ask whether the access would survive a restart. |
| A backdoor is written into the registry Run key | Installation | Establishing a foothold that outlives the initial exploit. |
| An infected host beacons to an external server every 60 seconds | Command & Control | The attacker now has a remote channel. Beaconing and DNS tunnelling both live here. |
| Traffic is tunnelled out over DNS to an attacker domain | Command & Control | The channel itself is C2, even when the goal is eventually exfiltration. |
| Customer records are copied to an external file-sharing service | Actions on Objectives | Exfiltration is the mission being accomplished, the final phase. |
| Files across the network are encrypted and a ransom note appears | Actions on Objectives | Impact on the target is the objective, not a step toward it. |
Information gathering
Attackers research and identify targets, gathering intelligence about the organization, employees, and technical infrastructure.
Exploit + payload
Attackers combine exploits with malicious payloads to create weaponized deliverables tailored to the target environment.
Payload transport
The weaponized payload is transmitted to the target through various delivery mechanisms, with email being the most common vector.
Code execution
The attacker triggers the exploit, taking advantage of vulnerabilities in applications, operating systems, or human psychology.
Persistence setup
Attackers install backdoors, remote access trojans, or other persistence mechanisms to maintain access to the compromised system.
Remote communication
The compromised system establishes communication with external command-and-control (C2) servers, giving attackers remote access.
Mission accomplishment
With full access established, attackers execute their ultimate goals: data theft, destruction, or further compromise.
In order: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives. The model is sequential by design. The defensive point is that breaking any single link stops the chain, so you do not need to catch an intrusion at phase one to stop it.
Delivery is the payload being transmitted to the target: the phishing email sent, the USB drive dropped, the malicious page hosted. Exploitation is the moment code actually executes on the victim system, which usually requires the victim to act or a vulnerability to be triggered. A phishing email sitting unopened in an inbox is Delivery. The macro running when the attachment is opened is Exploitation. Exam questions test this boundary more than any other.
Installation is establishing persistence on the host so that access survives a reboot, such as a registry Run key, a scheduled task or a new service. Command and Control is the outbound channel back to the attacker, such as HTTP beaconing or DNS tunnelling. Installation is about staying in; C2 is about being reachable. An intrusion can have one without the other.
Lockheed Martin, in a 2011 paper by Hutchins, Cloppert and Amin titled "Intelligence-Driven Computer Network Defense". It adapts a military targeting concept to network intrusions. This origin is why it is attacker-centric and linear, and why later models were proposed to address those limits.
The Kill Chain is a linear seven-phase narrative of an intrusion, useful for teaching and for deciding where to place defences. MITRE ATT&CK is a much larger matrix of specific observed techniques mapped to tactics, and it does not assume a fixed order. In practice they are complementary: the Kill Chain gives you the shape of an attack, ATT&CK gives you the detail of how each step is actually carried out.
It is perimeter and malware focused, so it fits an external intrusion better than an insider threat, a stolen credential used at the front door, or a supply chain compromise. It is also strictly linear, while real intrusions loop and run steps in parallel. Most teams therefore use it as a teaching and coverage-checking model rather than a literal description of every attack.