Reflecting on the Cyber Kill Chain

A small booklet to get your team up to scratch

Aug 22, 2025

The Cyber Kill Chain (CKC) is a structured model originally proposed by Lockheed Martin to represent the stages of a cyberattack. It enables defenders to identify, disrupt, and mitigate threats at each phase. This model uses a military-inspired approach to describe the sequence from initial target identification to the fulfilment of the attacker’s objective.

The stages, often understood as seven linked steps, include: reconnaissance, weaponisation, delivery, exploitation, installation, command and control (C2), and actions on objectives. That structure supports mapping security controls at each point.

Reconnaissance

Reconnaissance is the attack’s first stage, in which an adversary gathers information about the target. This can involve passive methods such as open-source intelligence (OSINT), public-domain research, or active scanning and probing that may leave traces.

The attacker may map network configurations, profile key personnel, locate third-party relationships, identify exposed services and linger behind firewall or access boundaries. This phase determines the attack surface and potential entry points. Packt SecPro emphasises how the CKC provides the military-inspired framework for understanding this phase.

From a defensive perspective, reconnaissance presents an opportunity to detect unusual scanning, abnormal access to internal resources, or other early indicators of probing activity.

Weaponization

Weaponisation follows reconnaissance. In this stage, the attacker assembles or adapts a malicious payload that targets identified vulnerabilities. This might include crafting malware, embedding exploits in documents, or developing backdoor tools.

Attackers may modify existing malware or create new variants to evade detection, such as encrypting malware or using polymorphic code. The payload is tailored to the target’s environment and security controls.

Defenders must consider how attacker-crafted payloads function and guard against suspicious payload characteristics. Threat intelligence may help flag emerging tools similar to those weaponised in recent campaigns.

Delivery

Once crafted, the weapon must be delivered to the target. Delivery commonly uses phishing emails, malicious attachments, spear-phishing, exploit kits, compromised websites, USB drops, or supply-chain mechanisms.

Delivery may also proceed indirectly, through third-party or partner networks, or via operational technology environments. Emergency or routine update vectors present subtle delivery paths.

Defensive strategies include email filtering, attachment sandboxing, web filtering, threat intelligence feeds, endpoint isolation, and awareness training for users.

Exploitation

After delivery, exploitation occurs. The payload activates by exploiting a vulnerability—software, protocol, OS misconfiguration, or a user mistake—to gain execution capabilities on the target system.

Once executed, the attacker may perform privilege escalation, alter configurations, or move laterally within the network. Packt SecPro notes that exploitation breaches a system’s defences and may permit lateral movement.

Detecting exploitation requires behaviour-based monitoring, application monitoring, or anomaly detection tools. Prevention includes timely patching, multi-factor authentication, and hardening configurations.

Installation

Installation refers to establishing persistent access. The attacker installs malware, backdoors, remote access trojans (RATs), or command-line tools to maintain a long-term presence.

This stage follows exploitation and ensures continued access even if the initial entry is identified and blocked. Installations may include registry modifications, scheduled tasks, or service persistence mechanisms.

Defenders must monitor for unusual binaries, configuration changes, or service creation. Endpoint protection platforms and file integrity monitoring help detect installation attempts.

Command and Control (C2)

Command and Control (C2) is the phase where the attacker establishes communication channels with the compromised host to relay instructions or exfiltrate data.

C2 often uses covert channels like beaconing via DNS, HTTP, HTTPS, or domain generation algorithms (DGAs). Examples include controlling botnets to initiate attacks, exfiltrate data, or deploy ransomware.

Effective defences include network monitoring, detection of anomalies in outbound traffic, proxy logs analysis, and use of sinkholes to block known C2 domains.

Actions on Objectives

This final stage involves executing the attacker’s goal. Objectives can include data exfiltration, encryption for ransom, service disruption, intellectual property theft, or destruction of files.

Actions may take different forms depending on threat actor strategy: deploying ransomware, launching a DDoS, exfiltrating sensitive data, or maintaining covert access for espionage.

Defenders should ensure robust data loss prevention, encryption at rest, secure backups, and incident response planning to manage these eventualities effectively.

Model Origins and Value

The CKC was introduced by Lockheed Martin in 2011 as part of their Intelligence-Driven Defense approach. It remains a valuable analytic tool for mapping security controls to attack phases and guiding red teaming and forensic activities.

Splunk highlights that interrupting an attack at any stage reduces risk and impact, and combining CKC with threat intelligence, automation, and unified workflows strengthens defence posture.

Critiques of the Model

Despite its utility, the CKC model has known limitations:

Perimeter Bias
The model emphasises external threats and may not cover insider attacks, cloud-native threats, or fileless malware.
Linearity Assumption
Real-world attacks may not follow every stage sequentially. Some skip steps or advance in parallel.
Outdated Scope
The original model has not evolved substantially since 2011 and may lack relevance against modern threats like ransomware-as-a-service or AI-driven attacks.
Limited Early-Stage Detection
Reconnaissance often occurs outside the defended perimeter, making early detection difficult.
Cloud and Insider Gaps
The model does not account for insider threats or cloud-based attack vectors.

These critiques led to the development of extended frameworks.

Extended and Alternative Frameworks

Unified Kill Chain

The Unified Kill Chain merges CKC and MITRE ATT&CK, expanding to 18 stages grouped into initial foothold, network propagation, and action on objectives. This model addresses internal movement and enhances granularity.

Complementary Use with MITRE ATT&CK

MITRE ATT&CK provides detailed tactics, techniques, and procedures (TTPs) without assuming a linear chain. Security teams often use ATT&CK to complement CKC with greater flexibility and granularity.

Cyber COBRA

Cyber COBRA (Contextual Objective Rating) is an emerging approach that applies contextual threat scoring to kill chain stages, making response prioritisation more dynamic.

Technical Reflection

For readers with cybersecurity training, the CKC remains foundational. Each stage corresponds to a distinct technical activity:

Reconnaissance: OSINT, DNS sniffing, port scanning, exposed services.
Weaponization: Malware crafting, exploit packaging, payload obfuscation.
Delivery: Phishing frameworks, exploit kits, supply-chain trojans.
Exploitation: Memory corruption, privilege escalation, code injection.
Installation: Persistence techniques, registry keys, scheduled tasks.
C2: Beaconing, encrypted channels, protocol tunnelling.
Actions on Objectives: Data exfiltration via FTP or HTTPS, ransomware encryption, lateral movement for espionage.

Security operational teams can map each step to detection and mitigation measures: IDS/IPS, sandboxing, EDR, network telemetry, DLP, and incident response playbooks. Simulation platforms mirror CKC phases to test controls and response readiness.

Conclusion

The Cyber Kill Chain provides a structured, technical framework for analysing cyberattacks. It defines seven stages—reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives—that guide defenders in mapping detection and response capabilities.

The CKC’s value lies in its clarity and adaptability for red team, blue team, and incident response activity. However, defenders must remain aware of its limitations. Modern attack paradigms require supplemental models like MITRE ATT&CK, Unified Kill Chain, and adaptive scoring, such as Cyber COBRA.

In practice, security teams should use CKC as a foundational scaffold, then enrich it with granular intelligence, behaviour modelling, and continuous context. This ensures robust defence in the face of evolving threat techniques and complex environments.