2 min read
Topic 14 of 21
14
Cyber kill chain
The Cyber Kill Chain is a model developed by Lockheed Martin to describe the stages of a cyber attack. It helps organizations understand, detect, and defend against...
Cyber Kill Chain
The Cyber Kill Chain is a model developed by Lockheed Martin to describe the stages of a cyber attack. It helps organizations understand, detect, and defend against attacks by analyzing how attackers operate.
Purpose of the Cyber Kill Chain
- Provides a structured view of the attack lifecycle.
- Helps identify attacks early in the chain to prevent damage.
- Assists in designing defense strategies at each stage.
The 7 Stages of the Cyber Kill Chain
| Stage | Description | Example / Technique |
|---|---|---|
| 1. Reconnaissance | Attacker gathers information about the target. | Scanning networks, searching social media, WHOIS lookup |
| 2. Weaponization | Attacker creates a malicious payload tailored to the target. | Malware, exploit kits, phishing email attachments |
| 3. Delivery | The weapon is transmitted to the target. | Email phishing, drive-by download, USB drop |
| 4. Exploitation | Exploit is triggered to gain access. | Exploiting software vulnerabilities, macros in documents |
| 5. Installation | Malware or backdoor is installed on the target system. | Trojans, rootkits, Remote Access Trojans (RATs) |
| 6. Command and Control (C2) | Attacker establishes a communication channel to control the system. | Using C2 servers to send commands and receive stolen data |
| 7. Actions on Objectives | Attacker achieves their goal. | Data theft, ransomware encryption, sabotage, espionage |
How the Cyber Kill Chain Helps Defense
- Detection – Identify threats at each stage (e.g., abnormal network traffic for C2).
- Prevention – Block stages like delivery or exploitation using firewalls, patching, or email filters.
- Incident Response – Helps teams respond systematically by knowing which stage is active.
- Threat Intelligence – Understanding attacker techniques improves future defenses.
Defense Strategies at Each Stage
| Stage | Defense Measures |
|---|---|
| Reconnaissance | Hide sensitive info, limit public exposure, use honeypots |
| Weaponization | Threat intelligence to identify malware patterns |
| Delivery | Email filtering, anti-malware, content inspection |
| Exploitation | Patch management, endpoint security, vulnerability scanning |
| Installation | Application whitelisting, intrusion prevention systems |
| Command & Control | Network monitoring, firewall rules, anomaly detection |
| Actions on Objectives | Data encryption, access controls, backups |
Summary
The Cyber Kill Chain is a step-by-step model of a cyber attack: Reconnaissance → Weaponization → Delivery → Exploitation → Installation → Command & Control → Actions on Objectives. By understanding each stage, organizations can detect threats early, implement preventative measures, and respond effectively to attacks.
Past Papers
Open this section to view and download past papers
Click on Show Past Papers to load available exam papers.