What is Cyber Kill Chain?
Cyber Kill Chain is a seven-stage model that describes how an attacker moves from initial reconnaissance through to achieving their objective inside a target environment. Security teams use it to identify where in an attack sequence they can detect, disrupt, or contain a threat.
What it is
The Cyber Kill Chain was introduced by Lockheed Martin in 2011. It breaks an intrusion into seven sequential stages:
- Reconnaissance - the attacker gathers information about the target.
- Weaponization - a payload is crafted, such as a malicious document or exploit.
- Delivery - the payload is sent via email, a website, or removable media.
- Exploitation - the payload triggers a vulnerability on the target system.
- Installation - malware or a backdoor is placed on the compromised host.
- Command and Control (C2) - the attacker establishes a remote channel to the implant.
- Actions on Objectives - the attacker carries out their goal: data theft, ransomware deployment, lateral movement, or destruction.
Each stage represents a point where defenders can intervene. Stopping an attacker at stage two or three is far cheaper than responding after stage seven.
Why it matters
The model gives security teams a shared vocabulary for describing where an attack is in its lifecycle. Incident responders can map evidence to a stage and ask: "What must have happened before this?" and "What is likely to happen next?" This guides log review, forensic collection, and containment decisions. Detection engineers write rules that target specific stages. Threat hunters form hypotheses around gaps between stages where telemetry may be missing.
How tools address it
Threat hunting platforms that map findings to kill chain stages help analysts prioritize. Tools aligned to MITRE ATT&CK, such as analytics repositories or agentic hunting platforms, extend the model with granular technique-level detail. SIEM and XDR products correlate events across stages to surface multi-step attack patterns. Malware analysis tools examine weaponized payloads at stage two. Honeypots and deception technology detect reconnaissance and lateral movement at stages one and six.