7.1 Cyber Kill Chain Stages vs MITRE ATT&CK
Key Takeaways
- Lockheed Martin's Cyber Kill Chain uses seven stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives.
- The model's purpose is to show that an attacker generally needs the chain to succeed, while a defender can break the intrusion at any one stage.
- Weaponization almost always happens on attacker infrastructure, so victim logs rarely show that stage.
- MITRE ATT&CK catalogs adversary behaviors (tactics and techniques) in a matrix; it is not a required linear sequence the way the Kill Chain is taught.
- A phishing-macro-C2 incident can be told as seven Kill Chain stages and as ATT&CK techniques such as T1566.001, T1204.002, T1547.001, and T1071.001.
Why analysts still learn the Cyber Kill Chain
In 2011, Lockheed Martin researchers Eric Hutchins, Michael Cloppert, and Rohan Amin described an intrusion kill chain in Intelligence-Driven Computer Network Defense. The public name is the Cyber Kill Chain: seven stages an adversary typically progresses through to finish a network intrusion. The official stages are Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control (C2), and Actions on Objectives.
The purpose is practical, not decorative. First, the attacker generally needs the chain to succeed—especially through C2—before they can reliably complete the mission. Second, the defender can stop the intrusion by interrupting any stage with a control that actually fires. That defender-favored math is why entry-level analysts still use the model as a storytelling and triage frame.
This section is independent study material covering Security Analyst Level 1 (SAL1) topics. TryHackMe SAL1 training content lists the Cyber Kill Chain as its own topic: know the stages, know the purpose for understanding attacks, and know how the model differs from the MITRE ATT&CK Framework.
The seven stages
Reconnaissance
The adversary researches and selects targets. Passive reconnaissance uses job ads, conference speaker lists, DNS and certificate-transparency logs, leaked credential dumps, and social media. Active reconnaissance touches the target: port scans, noisy crawling, or password spraying a VPN. Passive work rarely lights up a Security Operations Center (SOC) queue. Active work may show as scanning detections, but many campaigns finish Reconnaissance entirely off your network.
Output of the stage: email naming patterns, who approves invoices, which VPN the help desk mentions in public posts, and which file types finance actually opens.
Weaponization
The adversary builds the deliverable on their own systems. The Lockheed Martin paper describes coupling a remote-access trojan with an exploit inside a client document (Office or PDF) using an automated weaponizer. A modern analogue is a builder that injects a Visual Basic for Applications (VBA) macro or packages a loader. You will almost never log Weaponization. Exam trap: do not pick Weaponization merely because malware exists. Ask whether the step happened before the payload left the attacker.
Delivery
The weapon is transmitted into the target environment. The original paper's common channels were email attachments, websites, and USB removable media. Delivery is the first stage that commonly creates your artifacts: an email-gateway log, a proxy GET to a malware site, or a USB insertion event.
Exploitation
Intruder code is triggered. That may exploit a software vulnerability, an insecure auto-execute feature, or the user (Enable Content / Open this PDF). After Exploitation, attacker-controlled instructions are running. Before Exploitation, you still have a hostile file sitting still.
Installation
A backdoor or remote-access component is planted so access survives logoff or reboot: an AppData drop plus a Registry Run key, a scheduled task, a service, a startup-folder shortcut, or a browser extension. Exploitation is a moment. Installation is a beachhead.
Command & Control
The implant phones home so operators gain interactive control (hands on the keyboard). Beacons may use HTTPS to a look-alike domain, DNS queries, or popular cloud APIs. Without C2, many payloads cannot receive new tasks. With C2, later objectives become remote operations rather than a one-shot script.
Actions on Objectives
Only now does the mission happen: copy databases, encrypt files, destroy backups, or treat the first host as a hop into the rest of the network. The Kill Chain bundles a large amount of internal activity here, which is one reason analysts also learn ATT&CK.
Purpose during triage
Use the chain to:
- Place an alert in the story (this is Delivery, not C2).
- Ask what evidence should exist one stage earlier and one stage later.
- Choose a control that interrupts the path you actually have (blocking internet macros at Delivery/Exploitation is cheaper than hashing a sample after data is gone).
- Brief non-SOC stakeholders in a linear narrative.
The chain is a lifecycle model, not a packet decoder. Real intrusions loop, skip stages, or run several chains in parallel (one chain for initial access, another for ransomware deployment).
| Stage | What the adversary does | Typical defender-visible trace | Example interrupt |
|---|---|---|---|
| Reconnaissance | Research and select targets | Often none; sometimes scan noise | Reduce public org charts; rate-limit scanners |
| Weaponization | Build the payload offline | Almost never in victim logs | Intel may later identify a builder family |
| Delivery | Transmit the weapon | Mail gateway, proxy, USB logs | Sandbox attachments; block macros from the internet |
| Exploitation | Trigger code execution | Office/reader child processes | Exploit protection; disable risky Office features |
| Installation | Plant persistence | New Run key, task, service | Alert on persistence locations |
| Command & Control | Open a remote-control channel | Beacons, new domains, odd DNS | Egress filtering; beacon analytics |
| Actions on Objectives | Steal, encrypt, destroy, or pivot | Staging archives, ransomware notes, lateral auth | Data-loss controls; privileged-access monitoring; isolated backups |
Contrast with MITRE ATT&CK
MITRE ATT&CK is a knowledge base of adversary behaviors. Tactics answer why the adversary is acting (get in, stay in, steal data). Techniques and sub-techniques answer how. Procedures are specific implementations (this group's macro plus this C2 family). ATT&CK is a matrix: many techniques sit under each tactic, and real operations jump around. Credential theft can precede discovery. Impact (ransomware) can skip quiet exfiltration.
| Question | Cyber Kill Chain | MITRE ATT&CK |
|---|---|---|
| What is it? | Seven-stage intrusion lifecycle | Catalog of tactics, techniques, and procedures |
| Order | Taught as a sequence the attacker wants to complete | Not a required sequence |
| Best analyst sentence | Where are we in this attack story? | Which named behavior are we seeing? |
| Attacker-side prep | Weaponization (usually invisible) | Resource Development (malware, domains, accounts) |
| Getting in | Delivery then Exploitation | Initial Access plus Execution |
| Staying in | Installation | Persistence (privilege escalation is a separate tactic) |
| Remote control | Command & Control stage | Command and Control tactic with many protocol techniques |
| The mission | Actions on Objectives | Collection, Exfiltration, Impact, plus Discovery and Lateral Movement |
| Detection grain | Stage labels | Technique IDs such as T1566.001 |
A Kill Chain limitation you should be able to explain: after Installation, a huge amount of real work—privilege escalation, lateral movement, credential dumping—gets stuffed into one bucket. ATT&CK's extra tactics exist because defenders need those labels to write detections. The Kill Chain remains useful for briefings and for remembering that early breaks (Delivery, Exploitation) are cheaper than recovering from Actions on Objectives.
ATT&CK Resource Development is the closest cousin to Weaponization. Initial Access overlaps Delivery plus the start of Exploitation. Execution covers Exploitation's code-ran moment. Persistence overlaps Installation. Command and Control shares a name with the Kill Chain stage but is a tactic with many techniques. Exfiltration and Impact split what the Kill Chain bundles as Actions on Objectives.
SAL1 training content compares the Cyber Kill Chain with MITRE ATT&CK. It does not treat expanded multi-stage unified kill-chain variants as training-content topics. Do not spend exam time mapping extra unofficial stages. Map Lockheed Martin's seven against ATT&CK behaviors.
Worked case: phishing, macro, C2
Facts. Maya in accounts payable receives Q3-Invoice-8891.xlsm from billing@vend0r-payments.example. The legitimate supplier uses vendor-payments.example. She clicks Enable Content. Endpoint detection later records EXCEL.EXE spawning wscript.exe, then update.exe in %APPDATA%\Microsoft\Templates\. A Registry value HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OfficeTemplateUpdate points at that path. The host beacons over HTTPS every 60 seconds to invoices-update.example. Before containment, \\filesrv01\finance\export.zip appears.
Kill Chain mapping
- Reconnaissance. Attackers collected Maya's address from a conference speaker PDF and learned invoice file types from a public how-we-pay-vendors page. No hospital sensor saw this.
- Weaponization. A builder produced the
.xlsmwith an auto-open VBA dropper on attacker infrastructure. - Delivery. The message traversed SMTP; the email security gateway logged the attachment and the look-alike sender domain. This is the first defender-visible stage.
- Exploitation. Enable Content caused VBA to run—human exploitation plus Office as the execution host.
- Installation.
update.exeplus the Run key. A reboot would still call back. - Command & Control. Periodic HTTPS to
invoices-update.example—the operator channel. - Actions on Objectives. Staging
export.zipon the finance share is collection toward theft (or a precursor to encryption).
ATT&CK mapping of the same facts
- Resource Development: malware construction; registering
invoices-update.exampleand the look-alike sender domain. - Initial Access: T1566.001 Phishing: Spearphishing Attachment.
- Execution: T1204.002 User Execution: Malicious File, and T1059.005 Command and Scripting Interpreter: Visual Basic.
- Persistence: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder.
- Command and Control: T1071.001 Application Layer Protocol: Web Protocols.
- Collection / Exfiltration: archive staging on a file share; likely transfer over the existing C2 channel (T1041) if the zip left the network.
Same incident, two vocabularies. The chain tells the story in order and highlights that Weaponization never hit a hospital log. ATT&CK names detections you can reuse next week: any user execution of macros, any new HKCU Run key, any new periodic HTTPS beacon—not only this invoice filename.
Analyst traps
- Calling the email Exploitation. The email arriving is Delivery; Exploitation starts when the macro or exploit runs.
- Assuming every intrusion shows all seven stages in your logs. Weaponization almost never does; Reconnaissance often does not.
- Treating C2 as the mission. C2 is the remote-control channel; the mission is Actions on Objectives.
- Forcing lateral movement into Installation. Installation is the beachhead on a host; moving to a domain controller is later behavior that ATT&CK models more clearly.
- Mixing framework names: do not dump ATT&CK technique IDs into a Kill Chain stage list as if they were the seven stage names.
When an alert lands, ask two questions in order: Where are we on the chain? Which ATT&CK technique does this look like? That dual mapping is the skill SAL1 training content is after.
A mail gateway logs a malicious Excel attachment, but no endpoint shows a child process from Excel. Which Cyber Kill Chain stage has definitely occurred in the victim environment?
What is the most accurate contrast between the Cyber Kill Chain and MITRE ATT&CK for a SOC analyst?
In the invoice-macro case, endpoint telemetry shows a new HKCU Run value named OfficeTemplateUpdate pointing at update.exe. Which Kill Chain stage is that persistence artifact?