What is the Cyber Kill Chain?
The Cyber Kill Chain is a model that describes an intrusion as a sequence of seven phases an attacker must complete to reach a goal. Lockheed Martin researchers published it in 2011, adapting a military idea: an attack is a chain of steps, and breaking any link stops it. Its value for defenders is that every phase is a chance to detect or block the attack, and the earlier the chain breaks, the less damage is done.
The seven phases
- Reconnaissance: researching the target, such as harvesting employee names, email formats and technologies from websites, job postings and social media.
- Weaponization: building the payload, for example pairing an exploit or a malicious macro with a document.
- Delivery: sending the weapon to the target by phishing email, malicious website, USB drive or similar means.
- Exploitation: the payload runs, triggered by a vulnerability or by a user opening it.
- Installation: the attacker sets up a persistent foothold, such as a backdoor or scheduled task, so access survives a reboot.
- Command and control (C2): the compromised host opens a channel back to the attacker for remote control.
- Actions on objectives: the attacker pursues the goal, such as stealing data, encrypting files or moving deeper into the network.
Breaking the chain
Each phase suggests defenses. The original paper paired the phases with defensive courses of action: detect, deny, disrupt, degrade, deceive and destroy.
| Phase | Example defense |
|---|---|
| Reconnaissance | Limit what job postings and staff profiles reveal |
| Delivery | Email filtering, attachment sandboxing, user training |
| Exploitation | Patching, macros disabled by default, exploit protection |
| Installation | Application allow lists, EDR |
| Command and control | Egress filtering, DNS filtering, proxy inspection |
| Actions on objectives | Data loss prevention, segmentation, immutable backups |
This is defense in depth applied across time. A phishing email that slips past the mail filter can still be stopped when the macro is blocked, when the backdoor fails to install, or when the beacon cannot reach its server.
A Cyber Kill Chain example
A criminal group researches a manufacturer's accounts-payable team (reconnaissance), builds a Word document with a malicious macro (weaponization) and emails it from a look-alike domain (delivery). A clerk enables macros, which runs PowerShell (exploitation), creates a scheduled task (installation) and beacons out over HTTPS (command and control). The attacker then dumps credentials, copies data out and runs ransomware (actions on objectives).
Limits of the model
The Kill Chain was built around malware-based intrusions from outside the network. It fits a stolen-credential login to a cloud service or a malicious insider less neatly, since those skip or compress several phases. Its last phase also lumps together a great deal of activity, from privilege escalation to exfiltration. MITRE ATT&CK's detailed tactics and techniques fill that gap, which is why many teams use the Kill Chain for the high-level story and ATT&CK for the specifics.
Cyber Kill Chain vs. ATT&CK vs. Diamond Model
- Cyber Kill Chain: an ordered timeline of seven phases.
- MITRE ATT&CK: a detailed catalog of tactics and techniques, not a strict sequence.
- Diamond Model: the adversary, capability, infrastructure and victim of a single event, and how they relate.
Cyber Kill Chain on the CompTIA Security+ exam
The Cyber Kill Chain is one of the threat frameworks named in SY0-801 objective 5.5 as a reference source for assessment work. Questions that list ordered phases, ask which phase comes before or after another, or ask where a control breaks an attack point at the Kill Chain. Know the order: reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives. Common traps swap weaponization and delivery or put installation before exploitation. Technique IDs point at MITRE ATT&CK instead, and the four corners of adversary, capability, infrastructure and victim point at the Diamond Model.