What is the Cyber Kill Chain?

The cyber kill chain was initially conceived as a linear progression of seven distinct steps:

Reconnaissance is the initial phase, where attackers identify a target and gather information. They focus on understanding their target’s network infrastructure, identifying weak points, and collecting data for later stages.

Attacker actions: Uses both active (direct interaction with the target’s systems, such as active scanning) and passive (using publicly available information, such as social media profiles) reconnaissance techniques. This includes scanning for potential vulnerabilities in software and systems, discovering network infrastructure, and client configurations (OS versions), and gathering information about employees (names, email addresses, and other personal details) from public sources.

Defender's mitigation: Robust network monitoring can detect unusual scanning activity. Technology that can detect and prevent lateral movement can significantly limit the scope of a reconnaissance operation. Employee training on recognizing phishing and other social engineering tactics can reduce the risk of information leakage.

In this stage, attackers combine an exploit (which leverages a vulnerability) with a payload (the malicious code to execute the attacker's desired actions), creating the "weapon."

Attacker actions: Attackers create weapons designed to bypass security measures and evade detection. This could include embedding malware in decoy documents (PDFs, Office documents), creating malicious scripts, and using exploit kits to automate vulnerability exploitation.

Defender's mitigation: Regular scanning for vulnerabilities and patching of systems and applications is crucial. Staying informed about the latest threat intelligence helps anticipate potential payloads and prepare defenses.

The attacker transmits the weaponized payload to the target.

Attacker actions: Delivery methods are often tailored to bypass target defenses, such as using social engineering to circumvent email filters. Common tactics include phishing emails, drive-by downloads (exploiting website vulnerabilities), watering hole attacks (compromising websites frequently visited by the target), and exploiting vulnerabilities in web applications or network services.

Defender's mitigation: Strong email and web filtering can block malicious content. Security awareness training educates users about attack vectors like phishing.

This is where the actual breach occurs, granting the attacker initial access.

Attacker actions: Attackers exploit software or web application vulnerabilities (e.g., buffer overflows, SQL injection, cross-site scripting) or use social engineering to trick users into executing malicious actions (e.g., opening malicious LNK files).

Defender's mitigation: Keeping software patched is essential. Deploying defense-in-depth that includes advanced antivirus with machine-learning and AI, along with extended detection and response technology is crucial. User education on phishing and social engineering, including recognizing suspicious file extensions like LNK, can significantly reduce risk.

The attacker installs malware or other tools to maintain persistent access.

Attacker actions: This includes installing backdoors, creating privileged accounts, modifying system configurations, and using rootkits to hide their presence. Tactics include installing backdoors, creating new user accounts with elevated privileges, modifying system configurations, and using rootkits to hide their presence.

Defender's mitigation: Endpoint Detection and Response (EDR) tools continuously monitor endpoint activity to detect and respond to suspicious processes and network connections indicative of malware installation. Security best practices like disabling unnecessary services and enforcing strong passwords, and two-factor authentication (2FA) reduce the attack surface. Regular vulnerability and malware scanning identifies existing infections and weaknesses.

Attackers establish communication with compromised systems to remotely issue commands, exfiltrate data, install further malware, or perform other malicious activities.

Attacker actions: Attackers often use obfuscation, encryption, various communication protocols (HTTP, HTTPS, DNS, ICMP), compromised infrastructure, anonymization networks (Tor), and Domain Generation Algorithms (DGAs).

Defender's mitigation: Network monitoring and traffic analysis can detect suspicious Comand and control (C2) servers connections. Firewalls can block known malicious C2 infrastructure. DNS filtering and sink-holing can disrupt malicious domains.

The attacker achieves their objective, such as data exfiltration, data encryption (ransomware), system disruption/destruction, or espionage.

Attacker actions: Tactics include data exfiltration (FTP, HTTP, encrypted tunnels), staging exfiltrated data, encrypting data (ransomware), and manipulating data.

Defender's mitigation: Data Loss Prevention (DLP) tools can prevent data exfiltration. File Integrity Monitoring (FIM) detects unauthorized file changes. Security Information and Event Management (SIEM) systems analyze logs for suspicious activity.