Expert · Threat intelligence and frameworks · topic 38 of 43 · 30 min
The Lockheed Martin Cyber Kill Chain
Explanation
Why a chain
Attacks are not one event; they are a series of steps that must all succeed. Lockheed Martin borrowed the military idea of a "kill chain" (the steps of an attack) and applied it to cyber intrusions. If the defender breaks any one link, the attacker has to start again.
The seven phases
| Phase | What the attacker does | Defender example |
|---|---|---|
| 1. Reconnaissance | Researches the target: staff names on LinkedIn, email formats, exposed servers | Limit public information; watch for scans |
| 2. Weaponization | Builds the attack, for example a malicious document paired with a payload (done on the attacker's side) | Hard to see; threat intelligence about tools helps |
| 3. Delivery | Sends it: phishing email, malicious link, infected USB, exposed service | Email filtering, web filtering, user reports |
| 4. Exploitation | Triggers the code: a user opens the file, or a software bug is exploited | Patching, disabling macros, exploit protection |
| 5. Installation | Installs malware or a backdoor for persistence | EDR, application allow-listing, no admin rights |
| 6. Command and control (C2) | The malware connects back to the attacker for instructions | Egress filtering, DNS and proxy monitoring, blocking known C2 |
| 7. Actions on objectives | Does what they came for: steal data, encrypt files, move further | Segmentation, data loss prevention, backups, rapid response |
Courses of action
The original paper pairs the phases with defender actions: detect, deny, disrupt, degrade, deceive and destroy. For example, at delivery you can detect (email alerts), deny (block the attachment type) or disrupt (strip links).
Kill Chain and ATT&CK compared
| Cyber Kill Chain | MITRE ATT&CK | |
|---|---|---|
| Published | 2011, Lockheed Martin | 2013 onward, MITRE |
| Detail | 7 high-level phases | 14 tactics and hundreds of techniques |
| Best for | Explaining an intrusion simply; showing where it was stopped | Detailed mapping, detection engineering, comparing groups |
| Weakness | Focuses on malware entering from outside; less about insiders, cloud and what happens after entry | Large; needs prioritising |
Many teams use both: the Kill Chain for the story in management reports, ATT&CK for the technical detail. Some practitioners also use the Unified Kill Chain, which combines ideas from both.
PHASES = ["Reconnaissance", "Weaponization", "Delivery", "Exploitation",
"Installation", "Command and Control", "Actions on Objectives"]
detected = ["Command and Control", "Delivery", "Installation"]
earliest = min(detected, key=PHASES.index)
print("Stopped at:", earliest)Common mistakes
- Thinking the chain ends at installation. Most damage happens in phase 7.
- Investing only at delivery (email filters) and nothing later. Assume some attacks get through.
- Forgetting attacks that skip phases, such as an insider who already has access, or stolen cloud credentials used directly.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
The Lockheed Martin Cyber Kill Chain · 1/7
An intrusion is a chain of steps. Break one link and the attack fails.
Prefer a video by a teacher? Find free videos on “Lockheed Martin cyber kill chain explained seven phases” on YouTube ↗
In real life: Where was it stopped?
A management report for a Chennai manufacturer says: "A phishing campaign (delivery) reached 40 staff. Three opened the attachment (exploitation). On one laptop, malware installed a scheduled task (installation), but egress filtering blocked its connection to the attacker's server (command and control), and the EDR alert led to isolation within 15 minutes. No data was taken (actions on objectives prevented)." Using the Kill Chain, non-technical leaders understand exactly which defences worked.
Practice (0/3 done)
Malware on a laptop tries to connect to the attacker's server for instructions, and the firewall blocks it. Which phase was broken?
Using PHASES (given, in order), write earliest_break(detected) that returns the earliest phase in detected (a list of phase names), or None if the list is empty. Then write phase_number(name) that returns the 1-based position of a phase.
Pick a public ransomware or phishing incident story (for example from a CERT-In advisory or a news report). Write one line for each of the seven Kill Chain phases describing what happened, and one control that could have broken the chain at that phase.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Using frameworks in detection and threat huntingThreat intelligence and frameworks · same module
- Threat intelligence and indicators of compromiseThreat intelligence and frameworks · same module
- Signals, kill and process priorityLinux and Red Hat (RHCSA to RHCE) · Processes, services and logs
- Post-exploitation ethics: what to do once you are inEthical Hacking and Penetration Testing (legal labs) · Post-exploitation ethics and reporting
- A repeatable method: PTES and OWASP WSTGEthical Hacking and Penetration Testing (legal labs) · Methodology and reconnaissance
- Active reconnaissanceEthical Hacking and Penetration Testing (legal labs) · Methodology and reconnaissance
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Who published the Cyber Kill Chain?
Answer: Lockheed Martin
Lockheed Martin published it in 2011.
How many phases does the Cyber Kill Chain have?
Answer: 7
Seven phases.
Building a malicious document with a payload is which phase?
Answer: Weaponization
Weaponization happens on the attacker's side before delivery.
Why is breaking the chain early better?
Answer: Less damage has happened and the response is cheaper
The further the attack progresses, the more it costs.
A common criticism of the Kill Chain is that it…
Answer: Focuses on outside malware intrusions and says less about insiders and later stages
It was designed around external intrusions; ATT&CK covers post-entry behaviour in detail.
What does T1566 represent in ATT&CK?Related
Why tag detection rules with ATT&CK technique IDs?Related
Answer: To measure coverage and find gaps against priority techniques
Tags let you map and measure what you can detect.
Post-exploitation is what defenders want to…Related
Answer: Detect: unusual access, lateral movement, data leaving
The blue team aims to detect exactly these behaviours.
Why start a new IPS in detect-only mode?Related
Answer: To tune rules before false positives start blocking real users
Tuning first avoids an outage caused by your own security tool.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 1 more topic in “Threat intelligence and frameworks” before its exam: Using frameworks in detection and threat hunting.
- Module 9 exam: Threat intelligence and frameworks · 12 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Careers and certifications. 43 topics left in the course before the final exam.