What Is the Cyber Kill Chain?
Developed by Lockheed Martin, the Cyber Kill Chain is a framework that describes the stages of a sophisticated cyberattack. Understanding this model is essential for defenders because every stage of the chain presents an opportunity to detect, disrupt, or neutralize the attacker before they achieve their objective.
The Seven Stages
Stage 1: Reconnaissance
The attacker gathers intelligence about the target — employees (via LinkedIn), technologies (via job postings and error messages), and exposed services (via Shodan and OSINT tools).
Defensive response: Minimize your digital footprint. Limit information exposed in job postings, configure servers to suppress version banners, and train employees on social engineering awareness.
Stage 2: Weaponization
The attacker creates a malicious payload — typically a document with an embedded macro, a weaponized PDF, or a drive-by download kit — and pairs it with an exploit.
Defensive response: This stage happens entirely off your network, so you cannot directly observe it. Your focus is on preventing the weapon from reaching or executing in your environment.
Stage 3: Delivery
The weapon is delivered to the target — most commonly via phishing email, a malicious website, or a compromised USB device.
Defensive response: Email security gateways with sandboxed attachment detonation, web filtering, user awareness training, and USB device controls.
Stage 4: Exploitation
The payload exploits a vulnerability — in software, in human behavior (social engineering), or in configuration (default credentials) — to gain initial code execution.
Defensive response: Aggressive patch management, application whitelisting, and disabling macros in Office documents for non-privileged users.
Stage 5: Installation
The attacker installs a persistent backdoor (RAT, webshell, or scheduled task) to maintain access even if the initial entry vector is closed.
Defensive response: EDR tools detecting suspicious process creation, persistence mechanisms, and anomalous parent-child process relationships.
Stage 6: Command and Control (C2)
The malware phones home to an attacker-controlled server, enabling remote control and receiving instructions.
Defensive response: DNS filtering, network traffic analysis detecting beaconing behavior, and blocking known malicious IP ranges via threat intelligence feeds.
Stage 7: Actions on Objectives
The attacker achieves their goal: data exfiltration, ransomware deployment, destructive attacks, or establishing a persistent foothold for future operations.
Defensive response: Data Loss Prevention (DLP), behavioral analytics detecting large-scale data transfers, and well-rehearsed Incident Response plans.
The Defender's Advantage
The Kill Chain model demonstrates that defenders have multiple opportunities to stop an attack. No single control is sufficient — layered defenses ("defense in depth") ensure that if one layer fails, subsequent layers catch the attacker before they succeed.
Oberon's 24/7 SOC monitors for Kill Chain indicators at every stage. Contact us to learn more.