Cyber Kill Chain

The cyber kill chain is a framework that breaks an intrusion into sequential stages so defenders can understand, detect, and disrupt attacker activity at multiple points.

What Is the Cyber Kill Chain?

Originally popularized by Lockheed Martin, the cyber kill chain describes how an attack progresses from reconnaissance to actions on objectives. It gives defenders a structured way to map coverage, identify gaps, and understand where a control or detection can interrupt an intrusion.

Typical Kill Chain Stages

1. Reconnaissance: Gathering information about the target
2. Weaponization: Preparing tools, payloads, or infrastructure
3. Delivery: Sending the payload through email, web, or other channels
4. Exploitation: Triggering the vulnerability or weakness
5. Installation: Establishing persistence or malware execution
6. Command and Control: Communicating with compromised assets
7. Actions on Objectives: Theft, disruption, exfiltration, or impact

Why It Matters

The kill chain helps teams think in sequences instead of isolated events. Even when an early-stage control fails, there may still be later opportunities to detect, contain, or stop the attack.

How FourCore ATTACK Relates

FourCore ATTACK helps teams emulate multiple stages of an attack chain and measure where controls detect, block, or miss the activity across the intrusion lifecycle.

Related Terms

• MITRE ATT&CK
• Initial Access
• Lateral Movement
• Tactics, Techniques, and Procedures (TTPs)