What is Cyber Kill Chain?

A model presented by the US company Lockheed Martin in 2011 that divides the flow of a targeted attack into seven stages. It assumes the attack proceeds through reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2) and actions on objectives, and defenders line up controls to break the chain at each stage. It conveys the idea that the earlier the chain is broken, the smaller the damage, but because it does not represent detailed post-intrusion activity or insider misconduct well, it is used together with MITRE ATT&CK and similar frameworks.

Japanese name: サイバーキルチェーン

Cyber Kill Chain appears in 1 practice question across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about Cyber Kill Chain

The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?

ADelivery → reconnaissance → weaponization → exploitation → installation → C2 (remote control) → actions on objectives
BReconnaissance → weaponization → delivery → exploitation → installation → C2 (remote control) → actions on objectives
CReconnaissance → delivery → weaponization → installation → exploitation → actions on objectives → C2 (remote control)

Show answer and explanation

Answer: B. Reconnaissance → weaponization → delivery → exploitation → installation → C2 (remote control) → actions on objectives

The Cyber Kill Chain describes an attack in seven stages: reconnaissance (researching the target), weaponization (preparing, for example, a file carrying attack code), delivery (getting it to the target by an email attachment or a website), exploitation (exploiting a vulnerability to run code), installation (making the malware persist), C2 (establishing a channel to an external command server) and actions on objectives (stealing or destroying information). Defenders line up controls according to the stage at which they can break the chain, and the earlier it is broken, the smaller the damage. For example, stopping a suspicious attachment at the email stage ends the attack at delivery. However, it does not represent insider misconduct or long post-intrusion activity well, so it is used together with the more detailed MITRE ATT&CK.

Cyber Kill Chain in the explanations

The Cyber Kill Chain describes an attack in seven stages: reconnaissance (researching the target), weaponization (preparing, for example, a file carrying attack code), delivery (getting it to the target by an email attachment or a website), exploitation (exploiting a vulnerability to run code), installation (making the malware persist), C2 (establishing a channel to an external command server) and actions on objectives (stealing or destroying information).
The Cyber Kill Chain presented by Lockheed Martin in 2011 d…

Questions that mention Cyber Kill Chain (1)

The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?

Books on Cyber Attacks and Defense in Practice Ad

Search Amazon for semiconductor Cyber Attacks and Defense in Practice

As an Amazon Associate I earn from qualifying purchases.

Back to the glossary