Cyber Kill Chain

The Cyber Kill Chain is a model that shows a targeted cyberattack as a chain of steps that follow one another — from gathering information about the victim all the way to the attacker reaching their real goal. It was developed in 2011 by Lockheed Martin as part of its Intelligence Driven Defense approach, taking the military idea of a kill chain into the world of networks. The core idea is simple: the attacker has to get through every link in the chain, while a defender only needs to break one link to stop the whole attack.

What are the phases of the Cyber Kill Chain?

The classic Lockheed Martin model has seven phases. In practice, attacks rarely move through them in order — some stages are combined or skipped.

1. Reconnaissance: gathering information about the target — OSINT, mapping domains and subnets, port scanning, working out which services are exposed and who the employees and third parties are (the supply chain).
2. Weaponization: preparing the payload — pairing an exploit with a payload, that is the code meant to run on the victim’s machine (e.g. a macro-enabled document, a crafted file, an implant). This happens on the attacker’s side, with no contact with the victim yet.
3. Delivery: getting the payload to the target — phishing and spear-phishing, a malicious website (drive-by), USB media, a supply-chain attack, or a direct hit on an exposed service.
4. Exploitation: triggering the payload by abusing a software vulnerability, a misconfiguration or a user’s mistake. As a result, the attacker’s code starts running inside the victim’s environment.
5. Installation: settling in for good (persistence) — a backdoor, an implant, an autostart entry, a service or a scheduled task. This way access survives a reboot.
6. Command & Control (C2): setting up a control channel to the attacker’s remote server. Often with encryption, tunneling over HTTPS or DNS traffic, and evasion techniques (beaconing, domain fronting).
7. Actions on Objectives: what the attacker came for — stealing data, encryption (ransomware), gaining higher privileges, lateral movement, or destroying and tampering with data.

How does the Cyber Kill Chain support defense?

The model’s strength is that you can attach concrete detection and blocking measures to each phase. The earlier you break the chain, the smaller the damage. Here are example controls framed as “detect — impede — disrupt”:

• Reconnaissance: reducing the attack surface, detecting scanning, analyzing logs at the network edge.
• Delivery: email filtering, checking attachments in an isolated environment (sandbox), DNS and web security, user awareness.
• Exploitation and installation: vulnerability and patch management, hardening, EDR, allowing only trusted applications (allowlisting), least privilege.
• C2: watching network traffic for unusual outbound connections, checking domain reputation, detecting regular beaconing.
• Actions on objectives: DLP, network segmentation, detecting lateral movement and unusual data transfers, incident response planning.

Why does the Cyber Kill Chain matter for the SOC and network monitoring?

For SOC, NDR and network monitoring teams, the model helps organize the data (telemetry) around the stages of an attack and check which sources cover which phases. Several phases leave traces mainly at the network layer:

• Delivery and C2 show up in network traffic. Flow analysis (NetFlow/IPFIX), DNS queries, TLS certificates and encrypted-traffic metadata (e.g. JA3/JA4 fingerprinting) let you detect control channels even without decryption.
• C2 beaconing has a telltale regularity — a fixed gap between connections, similar packet sizes. That can be caught with statistical and behavioral methods.
• Lateral movement and exfiltration surface as anomalies in internal (east–west) communication, unusual transfer volumes, or connections to new places — inside and outside the network.

Mapping alerts to chain phases makes it easier to set priorities. A detection at the C2 or actions-on-objectives stage means the attacker is already deep in the environment and you need to react immediately. Signals from early phases give you more time to stop the attack.

How does the Cyber Kill Chain differ from MITRE ATT&CK?

The two models often go together, but they work at different levels of detail:

• The Cyber Kill Chain is linear and high-level — it describes the order of attack phases and is good for planning and for talking about how far an intrusion has gone.
• MITRE ATT&CK is an extensive, non-linear knowledge base of specific adversary tactics, techniques and procedures (TTPs). The techniques are not in a fixed order and are mapped to real-world observations.

In short: the Kill Chain answers “what stage are we at?”, while ATT&CK answers “which technique exactly are we seeing and how do we detect it?”. Together they give both a strategic and an operational view.

What are the limitations of the Cyber Kill Chain?

The model is often criticized — mainly because it reflects the realities of around 2011:

• Linearity: it assumes a tidy order, while real attacks combine or skip phases. A large share of intrusions squeeze the early stages into a single action.
• Perimeter and malware focus: it describes externally delivered, payload-based attacks well, but handles living-off-the-land techniques (abusing tools already present on the system), fileless attacks, abuse of valid credentials and web-application vulnerabilities (e.g. SQL injection, XSS) far less well.
• It ignores insider threats: the first phases play out outside the organization’s infrastructure, so the model does not cover malicious insiders or the abuse of legitimate access.
• Poor fit for cloud and identity: cloud environments, SaaS, containers and identity-based attacks do not map well onto the original network- and endpoint-centric scheme.

What is the Unified Kill Chain?

The Unified Kill Chain is an extension proposed in 2017 by Paul Pols that merges the Cyber Kill Chain with MITRE ATT&CK. Instead of seven phases it defines 18 interconnected stages, usually grouped into three blocks: gaining an initial foothold, network propagation, and actions on objectives. It better captures lateral movement, persistence and multi-stage campaigns, including aspects of insider threats that the classic chain does not cover.

Learn more

• Zero-Day Exploit — A zero-day exploit can be used in the weaponization or delivery stages of the Cyber Kill Chain.
• Incident Response Lifecycle — Incident response covers detection and containment after a Cyber Kill Chain attack reaches later stages.
• APT (Advanced Persistent Threat) — APT campaigns often follow the Cyber Kill Chain stages to gain and maintain long-term access.