The Cyber Kill Chain Explained: 7 Stages of a Cyber Attack

The Cyber Kill Chain is a model that breaks a cyber attack into seven sequential stages, from an attacker's first research to their final objective. Developed by Lockheed Martin, it gives defenders a shared language for understanding how intrusions unfold and, crucially, where they can be stopped.

The core insight is simple but powerful: an attacker must complete every stage to succeed, but a defender only needs to break one link to disrupt the whole attack. Understanding the chain helps SOC analysts detect threats earlier and respond with precision.

Key Takeaways

• The Cyber Kill Chain has 7 stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives.
• An attack fails if defenders break any single link in the chain.
• Earlier detection means lower impact, catching an attack at delivery is far cheaper than at exfiltration.
• The model is great for structuring detection and response, and pairs well with MITRE ATT&CK.

The 7 Stages of the Cyber Kill Chain

1. Reconnaissance

The attacker gathers information about the target, employee names, email addresses, technologies in use, and exposed services. This may be passive (searching public sources, LinkedIn, WHOIS) or active (scanning for open ports). Defensive focus: minimize public exposure, monitor for scanning activity.

2. Weaponization

The attacker builds their payload, for example, coupling a malware backdoor with a document exploit to create a malicious file. This happens on the attacker's side, so defenders can't see it directly, but threat intelligence about known tooling helps. Defensive focus: threat intel, understanding common payload types.

3. Delivery

The weapon is transmitted to the target, most often via phishing email, a malicious link, a USB drop, or a compromised website. This is one of the best places to break the chain. Defensive focus: email filtering, user awareness training, web filtering.

4. Exploitation

The payload executes and exploits a vulnerability, when a user opens the attachment or the code triggers a software flaw. Defensive focus: patching, endpoint protection, disabling risky macros.

5. Installation

The attacker installs malware or a backdoor to establish persistence, so they retain access even after a reboot. Defensive focus: EDR, monitoring for new services, registry changes, and autostart entries.

6. Command & Control (C2)

The compromised host "phones home" to the attacker's server, opening a channel for remote control. Detecting unusual outbound connections here is a key SOC skill. Defensive focus: network monitoring, DNS analysis, blocking known C2 infrastructure.

A classic C2 indicator in network logs is a host repeatedly beaconing to a suspicious domain at fixed intervals:

10.0.0.14 -> update-sync[.]cdn-metrics[.]xyz  443  every 60s  (regular beacon)
# Consistent 60-second callbacks to a newly registered domain = likely C2 beaconing

7. Actions on Objectives

Having established control, the attacker pursues their goal, stealing data, encrypting files with ransomware, moving laterally, or destroying systems. Defensive focus: data-loss prevention, segmentation, rapid incident response.

How Defenders Use the Kill Chain

The kill chain turns defense into a series of opportunities. For each stage, a SOC team asks: Can we detect an attacker here? Can we deny, disrupt, or degrade their progress? The earlier in the chain you intervene, the smaller the damage. Blocking a phishing email at the Delivery stage costs almost nothing; discovering ransomware at Actions on Objectives can cost millions.

The model also helps analysts communicate. Saying "we caught this at C2" instantly tells the whole team how deep the intrusion got and what to check next.

Limitations of the Kill Chain

The model is intentionally linear, which is also its main weakness. Modern attacks, especially those using stolen credentials or insider access, don't always follow a neat sequence and may skip stages entirely. That's why many teams pair the kill chain with the more granular MITRE ATT&CK framework, which maps specific attacker techniques in detail.

Learning to map real alerts onto the kill chain is a core analyst skill. In the TechBiz Security SOC Analyst internship, you'll practice identifying which stage an attack has reached and choosing the right containment action, exactly how a working SOC thinks.

Frequently Asked Questions

Who created the Cyber Kill Chain?

The Cyber Kill Chain was developed by Lockheed Martin, adapting a military targeting concept to model the stages of a cyber intrusion.

What are the 7 stages of the Cyber Kill Chain?

They are: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives.

What is the difference between the Cyber Kill Chain and MITRE ATT&CK?

The Kill Chain is a high-level, linear model of attack phases. MITRE ATT&CK is a detailed, non-linear catalog of specific attacker tactics and techniques. Many teams use both together.

Why is breaking the kill chain effective?

Because an attacker must complete every stage to succeed, disrupting any single stage, such as blocking delivery or C2, stops the entire attack from reaching its objective.