Cyber Kill Chain

Lockheed Martin’s Cyber Kill Chain describes the sequential phases of a targeted intrusion. Its defensive value: each phase is an opportunity to detect and break the chain; the earlier you cut it, the less the damage.

flowchart TB
    A[Reconnaissance] --> B[Weaponization]
    B --> C[Delivery]
    C --> D[Exploitation]
    D --> E[Installation]
    E --> F["Command & Control"]
    F --> G[Actions on Objectives]

The 7 phases

1. Reconnaissance   target recon (OSINT, scanning; see recon, se-pretexting)
2. Weaponization    prepare the weapon (payload + exploit/decoy document)
3. Delivery         delivery (phishing, web, USB; see se-phishing, se-physical)
4. Exploitation     execution of the exploit/code on the victim
5. Installation      install persistence (see mal-persist)
6. Command & Control establish the control channel (see mal-c2)
7. Actions on Objectives  the real goal: theft, encryption, destruction

Defense at each phase (break the chain)

Recon          reduce footprint (se-pretexting), detect scanning
Weaponization  threat intel on kits/payloads (cti-fund)
Delivery       mail/web filtering, sandboxing, training (se-phishing)
Exploitation   patching (def-patch), hardening (def-bastionado), EDR (def-edr)
Installation   EDR, app control, persistence detection (def-sysmon)
C2             egress filtering, NDR, beacon analysis (def-red, dfir-red)
Actions        DLP, segmentation, backups (def-backup); exfiltration detection
# "detect as early as possible" -> cutting at recon/delivery beats cutting at 'actions'

Courses of action matrix

Per phase x defensive action: Detect, Deny, Disrupt, Degrade, Deceive, Destroy
-> map which control covers which phase and with what effect (basis of defense in depth)

Limitations and relation to ATT&CK

- the Kill Chain is LINEAR and perimeter/classic-intrusion centric
- it doesn't model iterative internal lateral movement or insider threats well
- ATT&CK (cti-attack) is more granular and non-linear -> often used together:
  Kill Chain for the high-level narrative, ATT&CK for the TTP detail
# there's a "Unified Kill Chain" that merges both approaches (18 phases)

Blue Team / operation

Map detections and controls to each phase: the goal is to cut as early as possible.
Use the Kill Chain for the incident narrative (dfir) and ATT&CK for the TTP detail.
Measure where detection gaps are per phase and prioritize (defense in depth).
Combine with the Diamond Model (Diamond model) to enrich the adversary analysis.

Real-world cases

The Kill Chain is the classic framework for structuring APT analysis since 2011 (Lockheed Martin).
Spear-phishing → exploit → C2 campaigns (RSA 2011, Ukraine) fit phase by phase.
The Unified Kill Chain is used to model modern attacks the linear version doesn’t capture.

Testing checklist

Map the incident/campaign to the 7 phases
Identify detection opportunities per phase
Assign controls to each phase (Detect/Deny/Disrupt…)
Prioritize cutting as early as possible (recon/delivery)
Detect coverage gaps per phase
Complement with ATT&CK (detail) and Diamond (adversary)
Use the narrative in the report (Intelligence reporting)