The 7 Phases of the Cyber Kill Chain
An intelligence-driven defense framework: the attacker's path from recon to objective, and where you break it.
1Reconnaissance
Information gathering
Attackers research and identify targets, gathering intelligence about the organization, employees, and technical infrastructure.
Attacker tactics
- OSINT collection
- Social media profiling
- DNS/WHOIS lookups
- Email harvesting
Defenses
- Monitor public information
- Employee security awareness
- Threat intelligence feeds
- Attack surface management
Reconnaissance detection
ShodanGoogle AlertsHave I Been PwnedPassiveTotalThreatCrowd
2Weaponization
Exploit + payload
Attackers combine exploits with malicious payloads to create weaponized deliverables tailored to the target environment.
Attacker tactics
- Malicious document creation
- RAT/Backdoor packaging
- Zero-day exploit integration
- Payload obfuscation
Defenses
- Threat intelligence sharing
- Signature development
- Behavioral analysis
- Malware sandboxing
Weaponization analysis
VirusTotalCuckoo SandboxYARA rulesHybrid AnalysisJoe Sandbox
3Delivery
Payload transport
The weaponized payload is transmitted to the target through various delivery mechanisms, with email being the most common vector.
Attacker tactics
- Spear phishing emails
- Malicious website hosting
- USB/removable media drops
- Watering hole attacks
Defenses
- Email security gateways
- Web content filtering
- USB device controls
- User awareness training
Delivery protection
Proofpoint TAPMicrosoft ATPMimecastURLVoidPhishTank
4Exploitation
Code execution
The attacker triggers the exploit, taking advantage of vulnerabilities in applications, operating systems, or human psychology.
Attacker tactics
- Buffer overflow
- Social engineering execution
- Zero-day vulnerability abuse
- Privilege escalation
Defenses
- Patch management
- Host-based IPS (HIPS)
- Application sandboxing
- Endpoint Detection & Response (EDR)
Exploitation prevention
Windows Defender Exploit GuardNessusOpenVASMetasploit (validation)Patch management tools
5Installation
Persistence setup
Attackers install backdoors, remote access trojans, or other persistence mechanisms to maintain access to the compromised system.
Attacker tactics
- RAT installation
- Registry modification
- Service creation
- Scheduled task setup
Defenses
- Anti-malware solutions
- File integrity monitoring
- Registry monitoring
- Application whitelisting
Installation detection
OSSEC/WazuhTripwireSysmonCarbon BlackProcess Monitor
6Command & Control
Remote communication
The compromised system establishes communication with external command-and-control (C2) servers, giving attackers remote access.
Attacker tactics
- HTTP/HTTPS beaconing
- DNS tunneling
- Social media C2 channels
- Encrypted communications
Defenses
- Network traffic monitoring
- DNS analysis & filtering
- Proxy log analysis
- Firewall egress filtering
C2 monitoring
WiresharkZeek/BroSuricataPi-holeRITA
7Actions on Objectives
Mission accomplishment
With full access established, attackers execute their ultimate goals: data theft, destruction, or further compromise.
Attacker tactics
- Data exfiltration
- Lateral movement
- Privilege escalation
- Data destruction/encryption
Defenses
- Data Loss Prevention (DLP)
- Network segmentation
- Privileged access monitoring
- Incident response activation
Actions prevention
VaronisForcepoint DLPSymantec DLPMicrosoft PurviewNetwork segmentation