Cyber Kill Chain

What Is the Cyber Kill Chain?

The cyber kill chain is a model that splits a targeted intrusion into seven steps the attacker has to complete in order. Three Lockheed Martin researchers, Eric Hutchins, Michael Cloppert and Rohan Amin, set it out in a 2011 white paper on intelligence-driven network defense. Lockheed Martin now presents the Cyber Kill Chain framework as part of its Intelligence Driven Defense model.

The idea comes from military targeting. US doctrine describes a kill chain of find, fix, track, target, engage and assess, and calls it a chain because one weak link breaks the whole process. The paper applies the same logic to network intrusions. The attacker has to get through every step, and in the authors’ words “just one mitigation disrupts the chain and the adversary.”

That changes how a defender thinks. The usual view is that the attacker always has the advantage. The kill chain view is that attackers reuse tools and infrastructure, so each intrusion you study tells you what to block earlier next time.

What Are the 7 Stages of the Cyber Kill Chain?

The 2011 paper defines the seven phases below. The middle column puts the paper’s definitions in shorter words. The right column gives the defender’s aim at that phase, taken from Lockheed Martin’s 2015 analyst guide, Gaining the Advantage.

Some articles add an eighth stage, monetization: turning the attack into money through ransom or the sale of stolen data. Lockheed Martin’s model has seven, and this page follows it.

The order matters for analysis. If you detect an intrusion at one phase, the earlier phases have already worked. The paper tells analysts to rebuild those earlier phases, because a phase you cannot reconstruct is a phase you cannot act on next time.

How Did the Kill Chain Stop a Zero-Day in 2009?

The 2011 paper includes a real case from Lockheed Martin’s own incident response team. In March 2009 the same adversary sent three targeted emails within three weeks. The first, on 3 March, went to five users with a PDF that exploited CVE-2009-0658 in Adobe Acrobat. Adobe had documented that flaw on 19 February but did not patch it until 10 March.

The second email arrived a day later with a new subject, new recipients and a different sending IP address. Its attachment used the same encryption method and key, the same exploit and the same installer. Those repeated details let the defenders block it and link both emails to one campaign.

On 23 March a third email carried a PowerPoint file with an exploit nobody had seen before. Microsoft acknowledged the flaw 10 days later in advisory 969136, now CVE-2009-0556, and patched it on 12 May 2009. The defenders stopped it anyway, because the attacker reused an IP address from the second attempt, the same backdoor and the same C2 server.

The table below follows the paper’s own indicator table, shortened. It is a useful template for writing up any campaign: one row per phase, one column per attempt.

The lesson the authors draw is about cost. A new exploit is only one change in a longer process. If the attacker repeats anything in another phase, a defender who tracks those indicators still wins. To get through, the attacker has to change every phase at once.

How Did the 2013 Target Breach Map to the Kill Chain?

In March 2014 the majority staff of the US Senate Committee on Commerce, Science, and Transportation published A “Kill Chain” Analysis of the 2013 Target Data Breach. It walks the public facts of the breach through the seven phases and points to places where the chain could have been broken. The report relies on media reports and expert analyses, so it often says “may” and “reportedly.”

• Reconnaissance. Simple internet searches may have shown the retailer’s supplier portal and facilities pages, and file metadata helped map its internal network. The report suggests limiting public vendor information.
• Delivery. Emails with malware reached a small HVAC contractor at least two months before the breach and stole its credentials for Target’s network. A former vendor manager said Target rarely required two-factor authentication from low-level contractors.
• Exploitation and installation. From that foothold the attackers appear to have reached the payment terminals and installed memory-scraping malware. The report says intrusion detection alerts fired as the data-theft malware went in, but the security team did not react.
• Actions on objectives. Stolen data left over FTP for about two weeks, to outside servers including one in Russia. About 40 million card accounts were exposed, and personal details of up to 70 million customers were stolen.

Two of the early steps happened outside the retailer’s network: what its public pages gave away, and a supplier’s mailbox. An internal security stack sees neither. That gap is where third-party risk and outside intelligence come in.

How Do Defenders Use the Kill Chain?

The 2011 paper pairs every phase with six courses of action from US information operations doctrine: detect, deny, disrupt, degrade, deceive and destroy. Its sample matrix, shortened below, lists one or more controls per phase; the destroy column is empty. The authors write that “completeness equates to resiliency”, so the useful question is which phases have no control at all.

Three habits from the paper and the guide make the matrix work in practice:

• Work backward. A detection at installation means delivery and exploitation already worked. Rebuild them so you can act on them next time.
• Study blocked attempts too. A blocked email can still hold an exploit or backdoor you have not seen. The paper calls this synthesis.
• Link intrusions into campaigns. Indicators that repeat across intrusions are the campaign’s key indicators of compromise. They are the best place to spend defensive effort.

Which Kill Chain Stages Can You See From Outside Your Network?

Weaponization happens entirely outside your network. Reconnaissance mostly does too. Attackers read social media, press releases and conference lists, and at most leave traces in the logs of your public sites and servers. Delivery is often prepared outside as well.

The Target case shows that early steps can also run through a supplier, where your internal tools see nothing. Outside intelligence looks where attackers prepare: your public attack surface, newly registered domains and the criminal markets where tools and access are sold.

Our own data shows several phases sold as separate products. The Brandefense Cybercrime Report 2026 read posts collected by Brandefense Blackhole, our cybercrime database, from 1 January to 27 October 2026. These are advertised offers in collected posts, not verified incidents, but they show where a defender can look early.

The access figures come from the report’s initial access chapter, which read 120 corporate network access offers in full. It also gives two rules for triage. Ask what an offer actually sells, because a website foothold, a rented server and a network point to different owners. And treat a list that names your domain as a lead to check against your own logs, not as proof of a breach.

When access is for sale, the buyer skips the early phases altogether. An initial access broker does the reconnaissance, delivery and exploitation, then sells the result. A stolen but working login does the same: MITRE lists Valid Accounts under Initial Access, Persistence, Privilege Escalation and Stealth.

How Does the Cyber Kill Chain Compare With MITRE ATT&CK?

MITRE ATT&CK is a knowledge base of attacker behavior. Its Enterprise matrix lists 15 tactics, each the “why” behind a group of techniques (version 20.1, read on 10 November 2026). The kill chain tells you roughly where an intrusion stands. ATT&CK tells you exactly what the attacker did there, which is what a detection rule needs.

The table maps each kill chain phase to the closest ATT&CK tactics. It is our mapping for orientation, not an official MITRE crosswalk.

Two ATT&CK tactics have no row: Stealth (TA0005) and Defense Impairment (TA0112) can happen at almost any phase. The Unified Kill Chain, first published by Paul Pols in December 2017, joins the two models. It has 18 phases grouped as getting in, hacking through and taking it out, and it adds phases the original lacks, such as social engineering and pivoting. The Diamond Model of Intrusion Analysis works alongside both: it records the adversary, capability, infrastructure and victim of each step.

What Are the Limits of the Cyber Kill Chain?

• It was built for one kind of attack. The paper presents the model “in the context of computer espionage” by advanced persistent threats that deliver malware.
• It centers on the perimeter. The Unified Kill Chain white paper calls the original “perimeter- and malware-focused” and says it misses attacks behind the perimeter. An insider threat shows the gap: someone who already has access never passes through delivery or exploitation.
• Phases can be skipped. Pols’s case studies found that attackers do not always move through every phase in order. That weakens the promise that one block always breaks the chain.
• The phases are coarse. “Exploitation” or “actions on objectives” can hide dozens of separate behaviors, which is why detection work moves to ATT&CK techniques.

None of this makes the model useless. It still gives incident reports a shared order, and it shows quickly which phases have no detection at all.

How Do You Apply the Kill Chain in Your Own Team?

1. Write out your last few incidents and near misses phase by phase. Mark the earliest phase where you had any evidence.
2. Fill a detect, deny and disrupt grid for your own tools. Every empty row is a gap.
3. Track the share of intrusion attempts blocked at delivery, the measure Lockheed Martin’s guide names.
4. Keep email, proxy and DNS logs long enough to rebuild delivery and C2 after the fact.
5. List what an attacker sees first from outside: VPN gateways, firewall admin pages, remote desktop and forgotten hosts.
6. Watch the phases you cannot see from inside: lookalike domains, leaked logins for your domain and access offers that describe your company.
7. Tag each detection with an ATT&CK technique as well as a kill chain phase, so the short model and the detailed one stay linked.

Brandefense covers the outside part of the chain. External Attack Surface Management maps what an attacker would find within minutes, and Dark Web Monitoring flags your data on criminal forums and markets.