Cyber Kill Chain

The Cyber Kill Chain is a model designed to provide structure for understanding and analysing a cyber attack. It was developed by Lockheed Martin¹ in 2011 as a way to understand how attackers move from early planning through to achieving their objective. It breaks down an attack into stages, helping a defender to identify where controls can block progress and improve detection, investigation, and containment activities. The concept of a kill chain is borrowed from military planning which is used to break an engagement into components which can be targeted for disruption.

What is it?

The Cyber Kill Chain breaks the activities of a cyber attack into a sequence of stages. The framework has seven stages:

1. Reconnaissance
2. Weaponisation
3. Delivery
4. Exploitation
5. Installation
6. Command and Control (C2)
7. Actions on Objectives

Its primary value is as a way to map attacker behaviours and align defensive actions to best detect, disrupt, and stop attacks before damage can escalate. The earlier an attack is stopped, the less damage that can occur. Most modern endpoint detection tools are designed to allow for interrupting an attack at numerous points along the attack path².

1. Reconnaissance

In the reconnaissance stage, an attacker attempts to obtain information about the target.

Passive Reconnaissance involves collecting information about the target without engaging with the target. Focusing on public websites, social media platforms, credential and data leaks, job advertisements, and news stories allows information to be gathered in a manner that isn’t easily detected.

Active Reconnaissance refers to methods of acquiring information about the target by engaging with it directly. This can involve any method of enumeration or information collection undertaken directly on the target or its technology stack. These techniques are much easier to detect that passive reconnaissance methods.

Defenders at this stage should focus on:

• Limiting publicly available information on systems and infrastructure
• Ensuring internal systems aren’t exposed to the internet
• Monitoring for external scanning activity

2. Weaponisation

The weaponisation stage is when the attacker prepares for the attack by acquiring necessary tools and malicious payloads. That could be anything from setting up infrastructure to support the attack (websites, domains, servers, proxies, C2 infrastructure) to developing scripts or malicious tools. At this stage the attack has not yet commenced and the victim is still unaware of the attacker.

There is no visibility for the defender at this stage, however, patching of system vulnerabilities can make tool preparation more difficult.

3. Delivery

Delivery is the stage where the attacker executes the prepared cyber attack. This could take the form of phishing emails, malicious domains, removable media, or other delivery channels. This is usually the first aggressive interaction with the victim, and the first reasonable opportunity for a defender to detect the attack.

The goal for defenders at this stage is to prevent delivery by focusing on:

• Email filtering
• Web filtering
• DNS protection
• Security awareness training

4. Exploitation

The exploitation stage is the point when the attacker ensures the malicious content provided to the victim is activated. This may be when a user triggers interaction, enters their credentials into a fake portal, or otherwise activates the attacker’s payload.

This is the stage that the attack goes from external to internal. Defenders should focus on endpoint detection tools, this is what they are specifically designed to detect.

5. Installation

Installation is the stage where the attacker attempts to maintain persistence on the target. The objective is to gain an access path that can be used at any time (a backdoor) ensuring that even if the initial access method is remediated persistence is maintained. Privilege escalation can also at this stage. This can involve installing malware, registering a rogue device, creating inbox rules, or using stolen credentials to login in and drop additional tooling.

Defenders should focus on anything that can be used to retain access after the current sessions ends:

• Registry changes
• Scheduled tasks
• Unusual process creations

Most endpoint detection tools can detect these.

6. Command and Control (C2)

The command and control stage is the point where an attacker establishes a communication channel to deliver commands to a compromised system. These commands are often hidden in standard web traffic to avoid detection. Remote commands could be sent to the system and executed at this stage.

Command and control requires communications across the network, which should be the focus for defenders:

• Network communications
• DNS filtering

7. Actions on Objectives

The final stage is actions on objectives, where the attacker carries out their goal. This is where the attacker’s actual intended activities are performed and can include data theft, fraud, disruption, espionage, or destruction.

This is where real damage happens and preventing it reaching this stage should have been the goal of defenders. If it reaches here, defenders should immediately start incident response and remediation activities.

• Containment
• Forensic investigation
• System restoration
• Regulatory and customer notifications
• Reputation management.

How to use the Cyber Kill Chain

The Cyber Kill Chain can be useful in defensive planning. Map system controls against which stage it is defending against. This makes it possible to identify gaps in control coverage and provides guidance about where to put more. Earlier stages of the Cyber Kill Chain should be prioritised as earlier interventions reduce damage and make remediation easier. Controls on the delivery and exploitation stages provide the best value for money.

The Cyber Kill Chain can help incident responds do three things:

1. Understand what has happened
2. Predict what may happen next
3. Decide where to act for maximum effect

If a security analyst detects malicious activity at the delivery stage it may be possible to block delivery entirely and prevent a system from being compromised. Similarly, if activity is detected at the installation stage the focus would be on containment activities to minimise more damage. The Cyber Kill Chain provides guidance on what is likely to have already happened based on a partial view of an incident. In turn, this can guide remediation and clean-up activities once the immediate threat has been neutralised.

As an example, a phishing email is reported. There are questions the security analyst should ask:

• The email has been delivered, but has exploitation occurred?
• Have credentials been compromised?
• Is there evidence of installation, persistence, or command and control traffic?
• What about data exfiltration?

The Cyber Kill Chain can provide a framework in the aftermath of an incident to assist analysis. Mapping the incident allows breaking down which controls worked, which didn’t, and whether detection activities need improvement. Once gaps have been identified, understanding the intention of an attacker facilitates evaluating and justifying investment into more controls.

Limitations

The Cyber Kill Chain is linear, assuming each step is followed by the next, which makes it less helpful in tracing multi-vector or complex attacks⁴. If the attacker doesn’t directly follow the standard path, skips steps, repeats steps, or uses multiple channels of attack, the Cyber Kill Chain can lead defenders to miss activity.

The Cyber Kill Chain has a perimeter focus, assuming all attacks come from outside the network. It also hasn’t been updated since it was released. It was created when most enterprise systems were on-premise with clear boundaries between secure and insecure. Modern threats can come from insiders, be cloud-native, arise from trusted third parties, or come through the supply chain.

While the Cyber Kill Chain implies that there is time for defenders to react, modern attacks are increasingly happening very fast. With the rise of AI systems and malware-as-a-service operators, attacks can take minutes instead of days, which leaves defenders very little time to react.

1. Cyber Kill Chain® | Lockheed Martin ↩︎
2. The Cyber Kill Chain: Steps, Examples and How to Disrupt It | Kaseya ↩︎
3. Image sourced from Try Hack Me ↩︎
4. Cyber Kill Chain Model Breakdown and How It Works? ↩︎

Co-pilot was used as part of the research process for this article. Several requests for information and sources were made to Co-pilot on 27 May 2026 which were then used to write this article.