Cyber Kill Chain
Last updated
Last updated
The Cyber Kill Chain is a framework that outlines the stages of a cyberattack, providing a structured understanding of how adversaries infiltrate and compromise target systems. By analyzing these stages, defenders can identify where an attacker is in the attack lifecycle and take appropriate measures to mitigate the threat. The framework consists of seven stages, each representing a critical step in the attack process:
Objective: Gather information about the target.
Attackers identify and research their target, collecting data from public sources (e.g., LinkedIn, company websites, job postings) to understand the organization's technology stack, security measures, and potential vulnerabilities.
Techniques include passive information gathering (e.g., social media, documentation) and active scanning (e.g., probing web applications, IP addresses).
Objective: Develop malware or exploits tailored to the target.
Attackers create lightweight, undetectable malware or payloads designed to provide remote access to the target environment. This stage often involves customizing the payload based on the target's antivirus or endpoint detection and response (EDR) tools.
Objective: Transmit the weaponized payload to the victim.
Common delivery methods include phishing emails (with malicious attachments or links), malicious websites, or social engineering (e.g., phone calls to trick victims into executing payloads). Physical methods, such as USB drives, may also be used.
Objective: Trigger the payload to execute code on the target system.
The attacker exploits vulnerabilities in the target system to gain initial access or control. This stage often involves leveraging software vulnerabilities or user actions (e.g., clicking a malicious link).
Objective: Establish a persistent presence on the compromised system.
Attackers deploy tools like droppers, backdoors, or rootkits to maintain access and evade detection. These tools allow the attacker to execute additional malware, steal data, or move laterally within the network.
Objective: Establish remote control over the compromised system.
The attacker sets up communication channels to control the malware and execute commands. Advanced attackers may use modular tools to ensure redundancy, allowing them to maintain access even if part of their infrastructure is discovered.
Objective: Achieve the attack's ultimate goal.
The final stage involves executing the attack's purpose, which may include data exfiltration, deploying ransomware, or gaining administrative control over the network. The specific objective varies based on the attacker's intent.
Non-Linear Progression: Attackers may repeat stages (e.g., returning to reconnaissance after installation) to expand their foothold in the network.
Defensive Strategy: The goal of defenders is to disrupt the attack as early as possible in the kill chain, ideally during the reconnaissance, weaponization, or delivery stages, to prevent further progression.
