Skip to content
The Incident Ledger

Cyber kill chain

noun · also Kill chain, Lockheed Martin Cyber Kill Chain · Lockheed Martin

Lockheed Martin's seven-stage model of an intrusion, from reconnaissance to actions on objectives, used to find where an attack can be stopped.

The Cyber Kill Chain, introduced by Lockheed Martin researchers in 2011, borrows a military idea: an attack is a sequence of steps, and breaking any single link stops it. The model describes seven stages:

  1. Reconnaissance: researching the target, for example harvesting employee emails.
  2. Weaponization: building the payload, such as a malicious document.
  3. Delivery: sending it to the victim, for example by email.
  4. Exploitation: triggering the code on the victim's system.
  5. Installation: establishing a foothold, such as a backdoor.
  6. Command and control: opening a channel the attacker can use remotely.
  7. Actions on objectives: doing what they came for, such as stealing or encrypting data.

Example

An email gateway blocks a malicious attachment at the delivery stage, so exploitation, installation and everything after never happen. Even if delivery succeeds, an EDR that blocks the backdoor at installation still breaks the chain.

Why it matters for a SOC analyst

The kill chain is a simple way to explain where an attack was stopped and how far it got, which is useful in incident reports and when talking to non-technical colleagues. It is less detailed than MITRE ATT&CK and fits malware-driven intrusions better than insider threats or cloud attacks, so most teams use it as an overview and ATT&CK for the details.

Related terms

  • MITRE ATT&CK

    A free, public knowledge base of adversary tactics and techniques based on real-world observations, used as a common language for attack and defense.

  • Tactics, techniques and procedures

    How an attacker operates: the goal of each step (tactic), the method used to reach it (technique) and the specific way it is carried out (procedure).

  • Command and control

    The channel attackers use to communicate with compromised systems: sending commands, receiving stolen data and delivering new tools.

  • Lateral movement

    The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.