The Cyber Kill Chain Explained

The Cyber Kill Chain is a seven-stage model of how a targeted intrusion actually unfolds, from the first bit of research to data walking out the door. Lockheed Martin published it in 2011, borrowing the military idea of a "kill chain" — the ordered steps an attack must complete to succeed. The useful part for defenders is the flip side: break any single link and the whole attack fails. You do not have to be perfect at every stage; you have to be good enough at one.

This page walks each stage in plain language: what the attacker is trying to do, how blue teams break the link, and which StashGrid cheat sheets and labs let you practise both sides. Use it as a map — when you learn a new tool or technique, place it on the chain and you will understand why it matters, not just how it works.

The seven stages at a glance

Notice the shape: the earlier you catch it, the cheaper it is. Stopping recon is annoyance; stopping actions on objectives is incident response. The whole point of the model is to push your detections left — earlier in the chain.

1. Reconnaissance

What happens. The attacker learns the target without touching much: employee names and emails, subdomains, exposed services, technologies in use, credentials leaked in old breaches. Passive OSINT leaves almost no trace; active scanning (port and service discovery) is noisier but far more detailed.

Breaking the link. You can't stop people from Googling you, but you can shrink what they find — close needless ports, scrub metadata, and watch for scanning and credential-stuffing patterns in your logs.

Practise it: the OSINT & Recon Tools sheet for passive discovery, the Nmap cheat sheet for active scanning, and the Common Ports sheet to know what an attacker sees when they scan you.

2. Weaponization

What happens. Now the attacker builds the payload: an exploit married to a deliverable — a booby-trapped Office document, a malicious installer, a loader that pulls the real malware later. This happens on the attacker's own infrastructure, so you never observe it directly.

Breaking the link. Because weaponization is invisible to you, defence here is indirect: study how these payloads are built and behave so you can recognise them at the next stage. This is exactly what a malware analyst does.

Practise it: the Malware Analysis Sandboxes sheet shows how to detonate and dissect weaponized files safely, and the Docker lab gives you a throwaway environment to do it in.

3. Delivery

What happens. The weapon has to reach the target. The classic routes are phishing email, a malicious or compromised website, a USB drop, and increasingly the software supply chain — poisoning a dependency or update that the victim installs willingly.

Breaking the link. This is the richest stage for prevention: mail and web filtering, attachment detonation, user awareness, and blocking risky file types. Most breaches are stopped — or missed — right here.

Related: supply-chain delivery is now a whole discipline of its own — see the AI supply chain sheet for how the same idea plays out with models and datasets.

4. Exploitation

What happens. The payload fires: it exploits a software flaw, a misconfiguration, or simply a user running what they were sent, and the attacker's code executes for the first time on the target.

Breaking the link. Patch known vulnerabilities, harden configurations, run as least-privilege, and enable exploit mitigations. Every unpatched service and over-permissioned account is an easier exploit.

Practise it: the guided Bandit and Natas labs are hands-on exploitation of real (deliberately weak) targets, the Reverse Shell sheet covers the payloads that exploitation delivers, and the Linux Privilege Escalation sheet is what an attacker reaches for the moment they land.

5. Installation

What happens. To survive a reboot and keep access, the attacker installs something persistent — a backdoor, a service, a scheduled task, a web shell. This is the moment a one-off exploit becomes a lasting foothold.

Breaking the link. Endpoint detection (EDR), application allow-listing, and file-integrity monitoring shine here. New services, odd autoruns, and unexpected binaries are exactly the signals to hunt for.

Practise it: spin up the sandboxes to watch how persistence is established, and use the Splunk lab to build the searches that surface a new backdoor in your logs.

6. Command & Control

What happens. The installed malware phones home. A C2 channel — over HTTPS, DNS, or a legitimate-looking service — lets the attacker send commands and receive results, often disguised as ordinary traffic and beaconing on a quiet interval.

Breaking the link. Egress filtering, DNS and proxy inspection, and beacon detection break the channel. If the malware can't call out, it can't be steered — which is why controlling outbound traffic is so powerful.

Related: the Reverse Shell sheet is the simplest form of a C2 channel, and the Common Ports sheet helps you spot traffic leaving on ports it has no business using.

7. Actions on Objectives

What happens. Finally the attacker does what they came for: exfiltrate data, deploy ransomware, tamper with systems, or pivot deeper into the network. Everything before this was setup; this is the damage.

Breaking the link. Network segmentation, data-loss prevention, anomaly detection, and a fast, rehearsed response limit how much an attacker can achieve even after everything else failed. Assume breach, and make the last stage the hardest.

Practise it: the Splunk SIEM lab is where you learn to catch exfiltration and lateral movement in log data — the detections that matter most when prevention has already failed.

How to actually use the chain

The Kill Chain is a thinking tool, not a checklist. Three ways it earns its keep:

• Map your detections. Take every alert and control you have and pin it to a stage. Gaps jump out — most teams discover they are heavy on stages 4–7 and blind on 1–3.
• Push detection left. Catching an intrusion at Delivery is a filtered email; catching it at Actions on Objectives is a breach notification. Invest in the earliest stage you realistically can.
• Frame an incident. During response, placing what you see on the chain tells you what has probably already happened and what to look for next.

Kill Chain vs MITRE ATT&CK

People often ask which to use. They answer different questions. The Kill Chain is a linear, strategic view — seven stages, great for explaining an intrusion and framing defence-in-depth. MITRE ATT&CK is a detailed matrix of the specific techniques attackers use within those phases, better for engineering concrete detections. Learn the Kill Chain first for the shape of an attack, then use ATT&CK to fill in the exact moves. They complement each other; you don't choose.

The chain still holds for AI attacks

Attacks on AI systems follow the same arc: reconnaissance of a model and its guardrails, "weaponized" prompts, delivery via a document or a tool the model reads, exploitation through prompt injection, and actions on objectives such as data exfiltration or misuse of the model's permissions. If you are working through the OWASP LLM Top 10, try placing each risk on the chain — the mapping is a genuinely useful way to reason about a new class of threat with an old, proven model.

Where to go next

• Start attacking (and defending) stage by stage in the hands-on labs.
• Keep the cheat sheets open while you work — each one lives at a specific link in the chain.
• Build the detection side in the Splunk SIEM lab.

A plain-language map of the Lockheed Martin Cyber Kill Chain, kept current and tied to hands-on practice. Spotted something out of date, or want a stage expanded? Tell me.