What is Cyber Kill Chain?

The model comes from a Lockheed Martin paper by Eric M. Hutchins, Michael J. Cloppert and Rohan M. Amin, Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. The authors took the term from US military targeting doctrine, where the chain runs find, fix, track, target, engage, assess, and is called a chain because any one deficiency interrupts the whole process. They pointed it at intruders. To succeed, an intruder has to build a payload, get it across a trusted boundary, establish a presence inside and act from there. The paper's argument is that the adversary must get through every stage to reach the objective, while the defender needs just one mitigation to disrupt the chain. Lockheed Martin still presents the Cyber Kill Chain as part of its Intelligence Driven Defense model for identifying and preventing intrusions.

The seven phases, as the paper defines them

1. Reconnaissance: researching, identifying and selecting targets, for example crawling conference proceedings and mailing lists for email addresses.
2. Weaponization: coupling a remote access trojan with an exploit into a deliverable payload, usually with an automated tool the authors call a weaponizer, and more and more often packaged as a PDF or Office document.
3. Delivery: getting the weapon to the target. From 2004 to 2010, Lockheed's incident response team (LM-CIRT) saw email attachments, websites and USB removable media as the three most common vectors.
4. Exploitation: triggering the intruder's code, through an application or operating system vulnerability, through the user, or through an operating system feature that runs code automatically.
5. Installation: putting a remote access trojan or backdoor on the victim system so the adversary keeps a presence.
6. Command and control: the compromised host beacons out to a server on the internet, which gives the intruders hands-on-keyboard access.
7. Actions on objectives: only now does the intruder go after the goal, typically collecting, encrypting and extracting data, sometimes attacking integrity or availability, or using the first host as a hop point to move laterally.

The paper pairs each phase with the defender actions of DoD information operations doctrine: detect, deny, disrupt, degrade, deceive and destroy. Its example matrix sets:

• web analytics (detect) and firewall ACLs (deny) against reconnaissance;
• a vigilant user, a proxy filter, in-line antivirus and queuing against delivery;
• HIDS, patching and data execution prevention against exploitation;
• NIDS, firewall ACLs, NIPS, a tarpit and DNS redirection against C2;
• and audit logs, quality of service and a honeypot against actions on objectives.

Build the same matrix for your own controls: a row with nothing past the detect column is a phase you can watch but not stop.

Weaponization happens on the attacker's own machines, but the paper's case study shows defenders detecting it anyway. In March 2009 LM-CIRT analyzed three targeted emails from one adversary. Each attachment hid its backdoor installer with the same trivial encryption algorithm. The first two used the same 8-bit key; the third used a new key, a new sender and a PowerPoint zero-day, but dropped an installer and backdoor identical to the earlier ones. The paper says intelligence gathered at the first attempt let the defenders stop the zero-day. The first lure also carried a harmless PDF copied from the website of the AIAA, the organization the email impersonated, which showed the analysts what the attacker had researched.

The paper makes two more points that shape SOC work. A detection in any phase lets analysts assume the earlier phases already succeeded. And conventional incident response starts after exploitation, which the authors describe as a self-fulfilling prophecy that defenders are always too late. Their answer is to push detection toward earlier phases, and to analyze blocked attempts as thoroughly as successful ones: if a known indicator stops an email, working through the rest of its kill chain can expose a new exploit or backdoor that the next attempt will reuse.

One intrusion, phase by phase, with the telemetry each phase leaves

This is a simulated example generated by SOCSimulator Research: the company, hosts, accounts and times are invented, external addresses come from documentation ranges and domains end in .example. Event IDs and table names follow Microsoft Learn; technique IDs follow ATT&CK v20.

Reconnaissance, 8 to 12 September 2026

203.0.113.61 requests the leadership page, the supplier page and the public supplier onboarding form (a PDF) from the company website, 41 requests in four minutes with a python-requests user agent. The web server access log records every request and nobody reads it until the case is open. ATT&CK files this as T1594 Search Victim-Owned Websites, tactic Reconnaissance (TA0043). The LinkedIn research that picked four accounts payable clerks as targets leaves nothing in your logs at all.

Weaponization, date unknown

The attacker builds Supplier_Onboarding_2026.docm from the real onboarding form plus a VBA macro whose PowerShell stage is XOR-encoded with a one-byte key. ATT&CK puts building your own malware under T1587.001 Develop Capabilities: Malware, tactic Resource Development (TA0042). None of this reaches your logs. What you get later is the document, and its decoding routine is an indicator that can match the next lure.

Delivery, 22 September, 09:41 UTC

A message from accounts@halden-supplies.example, a lookalike of a real supplier registered two days earlier, reaches four accounts payable mailboxes with the .docm attached. Microsoft Defender for Office 365 writes it to EmailAttachmentInfo with FileName, SHA256, SenderFromAddress and RecipientEmailAddress. T1566.001 Spearphishing Attachment, tactic Initial Access (TA0001). The gateway lets it through because the domain is too new to have any reputation.

Exploitation, 09:58

j.okafor opens the document on WS-AP-07 and enables content. WINWORD.EXE starts powershell.exe with -EncodedCommand. Sysmon event 1 (process creation) records it with the full command line and a ProcessGUID for correlation. Windows Security event 4688 records it too, but its command line field stays empty unless the Include command line in process creation events policy is on. In Defender XDR it is a DeviceProcessEvents row with InitiatingProcessFileName winword.exe. ATT&CK splits the step into T1204.002 User Execution: Malicious File and T1059.001 PowerShell, both Execution (TA0002). No software vulnerability was involved, and the paper's definition allows for that: exploitation can target the user rather than a flaw.

Installation, 09:58 to 09:59

PowerShell writes C:\Users\j.okafor\AppData\Roaming\SyncHost\synchost.exe (Sysmon event 11, FileCreate) and adds a value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run that launches it at logon (Sysmon event 13, registry value set; a DeviceRegistryEvents row in Defender XDR). T1547.001 Registry Run Keys / Startup Folder, tactic Persistence (TA0003), also listed under Privilege Escalation. Microsoft's Sysmon documentation points FileCreate at autostart locations and temporary and download directories, the common places malware drops during initial infection.

Command and control, from 10:01

synchost.exe resolves cdn-sync.example (Sysmon event 22, DNS query, which names the process that asked) and connects to 198.51.100.23 on port 443 about once a minute (Sysmon event 3, network connection, which is disabled by default and has to be switched on in the Sysmon configuration). The proxy log shows WS-AP-07 sending the same small request around 60 times an hour. T1071.001 Web Protocols, tactic Command and Control (TA0011).

Actions on objectives, 13:20 to 14:05

Someone is now typing through the C2 channel. net group "domain admins" /domain runs under the beacon's process tree (T1087.002 Domain Account, Discovery). Files are copied from the finance share on FS-FIN-01, and 7z.exe packs 2.3 GB into an encrypted archive (T1560.001 Archive via Utility, Collection). Then the beacon's outbound byte count jumps while the archive leaves over the same connection (T1041 Exfiltration Over C2 Channel). That is one kill chain phase spread across three ATT&CK tactics.

Where it was caught

The Office-spawns-PowerShell alert fired at 09:58 as Medium and waited in the queue. Tier 1 took it at 13:35, in the middle of actions on objectives. Placing the alert on the chain gave the next searches.

• Backward: delivery had already happened, so the file's SHA256 in EmailAttachmentInfo found the message and the three other recipients.
• Forward: if exploitation worked, look for installation (file and Run-key writes by the same PowerShell process) and for C2 (network events from whatever it dropped).

Both hit. The beacon had been running for three and a half hours, and the case changed from a malicious macro to an active intrusion with data leaving. The other three mailboxes still held the document, unopened. Working through those copies is the paper's synthesis step: the XOR key, the dropper path, the Run value and the C2 domain go into detections before the next lure arrives from a new sender.

Two queries cover the transitions that mattered here, written against the Defender XDR advanced hunting schema.

Exploitation, an Office application starting a script host:

DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("winword.exe", "excel.exe", "powerpnt.exe")
| where FileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

Command and control, a program in a user profile folder that keeps talking to the same public address hour after hour:

DeviceNetworkEvents
| where Timestamp > ago(6h)
| where RemoteIPType == "Public"
| where InitiatingProcessFolderPath contains @"\AppData\"
| summarize Connections = count(), ActiveHours = dcount(bin(Timestamp, 1h)) by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort
| where ActiveHours >= 4 and Connections >= 100
| sort by Connections desc

Legitimate per-user software such as sync clients and updaters lives under AppData too, so expect it in the first results. For each row the question is whether that remote address belongs to that program's vendor.

The cyber kill chain and MITRE ATT&CK

MITRE's FAQ calls the two complementary. ATT&CK describes adversary behavior at a lower level, its tactics are unordered and may not all appear in one intrusion, while the kill chain uses ordered phases for high-level objectives. Enterprise ATT&CK v20 has 15 tactics. A rough crosswalk:

• reconnaissance is Reconnaissance (TA0043);
• weaponization is closest to Resource Development (TA0042);
• delivery is Initial Access (TA0001);
• exploitation is Execution (TA0002), or Initial Access when the attacker exploits an exposed service;
• installation is Persistence (TA0003);
• C2 is Command and Control (TA0011).

Actions on objectives takes everything else: Privilege Escalation, Stealth (TA0005), Defense Impairment (TA0112), Credential Access, Discovery, Lateral Movement, Collection, Exfiltration and Impact.

Rules and reports written before v19 say Defense Evasion for TA0005; v19 split that tactic into Stealth and the new Defense Impairment. In this crosswalk nine of the 15 tactics land in the last phase, which is why the kill chain alone says little about what an attacker does after the first foothold.

The eight-phase list

Search results also carry an eight-phase list: reconnaissance, intrusion, exploitation, privilege escalation, lateral movement, obfuscation (anti-forensics), denial of service and exfiltration. Varonis publishes it as the phases of the cyber kill chain, and some vendor pages attribute it to Lockheed Martin. The Lockheed paper lists seven. The eight-phase list is a different model: it drops weaponization, delivery, installation and C2 as separate phases and spells out more of what happens inside the network.

The criticism

The paper's definitions assume malware: weaponization couples a remote access trojan with an exploit, and installation puts a trojan or backdoor on the host. An intruder who logs in to a VPN with stolen credentials, or an insider who already has access, skips weaponization, delivery and installation as written. Paul Pols's Unified Kill Chain white paper states the main criticism directly: the model is perimeter- and malware-focused, so it fails to cover other attack vectors and attacks behind the organizational perimeter. His model, first published in December 2017, extends and combines the kill chain and ATT&CK into 18 phases grouped as In, Through and Out, adding phases such as social engineering and pivoting. The second criticism is the strict order. Pols describes working through a network as a loop the attacker repeats for every segment on the way to the critical assets, and ATT&CK leaves its tactics unordered because an adversary's goals change during an operation.