Every cyberattack follows a pattern. In 2011, Lockheed Martin - the defense contractor - published a framework called the Cyber Kill Chain that maps the seven phases an attacker goes through from initial research to achieving their objective.The kill chain is a defender’s roadmap. If you understand every step an attacker must take, you can build defenses at each phase. Break any single link in the chain, and the entire attack fails.
The term “kill chain” comes from the military, where it describes the stages of an attack: find the target, fix the location, track movement, target with a weapon, engage, and assess results. Lockheed Martin adapted the concept for cybersecurity.
Use the mnemonic RWDEICE to remember the phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Exfiltration (Actions on Objectives).
1
Phase 1: Reconnaissance
What happens: The attacker researches their target before launching any attack. They collect information about the organization, its people, its technology, and its defenses.Techniques used:
OSINT (Open Source Intelligence): Searching public records, websites, social media profiles
DNS lookups: Finding domains, subdomains, and IP addresses
LinkedIn research: Identifying employees, job titles, and technologies used
Google dorking: Using advanced search operators to find exposed files or login pages
Port scanning: Probing for open network ports and services
Real-world example: Before attacking a company, an attacker searches LinkedIn and finds a system administrator who lists “Cisco ASA firewall” and “Windows Server 2019” in their skills. Now the attacker knows exactly what technologies to target.
Dumpster diving - attackers search physical trash for useful information during reconnaissance
What defenders can do: Monitor for suspicious reconnaissance activity (port scans, unusual DNS queries). Limit what employees share publicly. Use honeypots to detect probing.
2
Phase 2: Weaponization
What happens: The attacker builds their weapon. They pair an exploit (the code that takes advantage of a vulnerability) with a payload (the malicious code that runs after the exploit succeeds).Techniques used:
Creating a malicious PDF, Word document, or spreadsheet
Building a trojanized application
Developing a custom exploit for a known vulnerability
Purchasing exploit kits on the dark web
Real-world example: The attacker creates a Word document with a malicious macro. When the target opens it and clicks “Enable Content,” the macro downloads and installs a backdoor.What defenders can do: This phase happens entirely on the attacker’s side, so you cannot directly prevent it. However, keeping your systems patched reduces the vulnerabilities an attacker can weaponize.
3
Phase 3: Delivery
What happens: The attacker sends the weapon to the target. This is the first phase where the attacker interacts directly with the victim.Delivery methods:
Email: Phishing or spear-phishing with malicious attachments or links
Physical: Infected USB drives left in parking lots (baiting)
Supply chain: Compromising a trusted vendor or software update
Real-world example: In the Target breach, attackers sent a spear-phishing email to an employee at Fazio Mechanical - Target’s HVAC vendor. The email contained malware that gave attackers credentials to Target’s vendor portal.What defenders can do: Email filtering, web proxies, endpoint detection, user awareness training. This is one of the most effective phases to stop an attack.
4
Phase 4: Exploitation
What happens: The weapon fires. The vulnerability is exploited, and malicious code begins executing on the target system. The attacker gains their initial foothold.How exploitation occurs:
A user opens a malicious attachment and a macro executes
A user visits a compromised website and a drive-by download triggers
A software vulnerability is exploited remotely (buffer overflow, SQL injection)
A user plugs in an infected USB drive
Real-world example: The Target HVAC vendor employee opened the phishing email, and the malware exploited a vulnerability to steal their login credentials for Target’s vendor management portal.What defenders can do: Patch management (close vulnerabilities before they are exploited), application whitelisting, endpoint detection and response (EDR), Data Execution Prevention (DEP).
5
Phase 5: Installation
What happens: The attacker installs persistent access tools - backdoors, remote access trojans (RATs), rootkits, or web shells. The goal is to maintain access even if the initial vulnerability is patched or the user reboots.Tools installed:
RATs (Remote Access Trojans): Full remote control of the compromised system
Rootkits: Hide deep in the OS to avoid detection
Web shells: Backdoor scripts planted on web servers
Scheduled tasks: Malicious code that re-launches itself on reboot
Real-world example: After gaining access through the vendor portal, the Target attackers installed malware on Point-of-Sale (POS) terminals across thousands of stores. This malware scraped credit card data from memory during every transaction.What defenders can do: Endpoint detection, file integrity monitoring, application control, monitoring for unusual scheduled tasks or services.
6
Phase 6: Command and control (C2)
What happens: The installed malware establishes a communication channel back to the attacker’s server. This lets the attacker remotely control the compromised system, issue commands, and extract data.C2 techniques:
Beaconing: Malware periodically contacts the attacker’s server for instructions
DNS tunneling: Hiding C2 communication inside DNS queries
HTTPS: Blending in with normal encrypted web traffic
Social media: Using posts or comments on platforms as hidden command channels
Real-world example: The malware on Target’s POS systems communicated back to attacker-controlled servers, sending batches of stolen credit card data at scheduled intervals.What defenders can do: Network monitoring, DNS filtering, blocking known malicious domains, analyzing outbound traffic patterns for beaconing behavior.
7
Phase 7: Actions on objectives (exfiltration)
What happens: The attacker achieves their goal. This is what the entire operation was building toward.Common objectives:
Data theft: Stealing confidential files, customer data, intellectual property
Ransomware deployment: Encrypting all files and demanding payment
Destruction: Wiping systems, corrupting data
Lateral movement: Using the compromised system as a launching point to attack other internal systems
Espionage: Ongoing surveillance and intelligence collection
Real-world example: The Target attackers exfiltrated over 40 million credit card numbers and 70 million customer records to servers in Eastern Europe. The breach cost Target over $200 million.What defenders can do: Data loss prevention (DLP), network segmentation, access controls, monitoring for large data transfers, incident response plans.
The Target data breach is one of the most studied cyberattacks in history. Here is how it maps to every phase of the kill chain.
The attack timeline
What went wrong
The consequences
Kill chain phase
What happened
Reconnaissance
Attackers identified Fazio Mechanical, a small HVAC company that had network access to Target for billing and project management
Weaponization
Attackers created a phishing email containing the Citadel banking trojan
Delivery
The phishing email was sent to Fazio Mechanical employees
Exploitation
A Fazio employee opened the email. The Citadel malware stole their Target vendor portal credentials
Installation
Attackers used the stolen credentials to access Target’s network and installed POS-scraping malware on registers in 1,797 stores
Command and control
The POS malware communicated with attacker servers, sending stolen card data in batches
Actions on objectives
40 million credit card numbers and 70 million customer records were exfiltrated to servers in Eastern Europe
Several failures made this breach possible:
Network segmentation failure: The HVAC vendor had access to the same network as the POS systems. These should have been completely separate.
Ignored alerts: Target’s FireEye security monitoring system actually detected the malware and sent alerts. The security team in Minneapolis did not act on them.
Vendor management: A small HVAC company had direct network access to one of the largest retailers in the world without sufficient security requirements.
Delayed response: The breach went undetected for nearly three weeks. Target learned about it from the U.S. Department of Justice, not from their own security tools.
$18.5 million settlement with 47 states
$200+ million total cost of the breach
CEO and CIO both resigned
Target’s stock dropped significantly
Led to widespread adoption of chip-and-PIN credit card technology in the U.S.
Became a textbook case in cybersecurity education (including this camp)
The kill chain is not just an academic model - it is a practical defense strategy.
Break any link
An attacker must succeed at every phase. A defender only needs to stop one. If you block delivery, the exploit never fires. If you detect C2, you can cut the attacker off before they steal anything.
Shift left
The earlier you stop an attack, the less damage it causes. Catching reconnaissance costs nothing. Responding to exfiltration costs millions.
Layered defense
No single security control stops every attack at every phase. You need defenses at multiple phases so that if one fails, the next catches it.
Threat intelligence
Knowing what phase attackers are in helps you predict their next move and respond appropriately.
For each phase of the kill chain, defenders can take six types of action.
Phase
Detect
Deny
Disrupt
Degrade
Deceive
Contain
Reconnaissance
Web analytics, port scan alerts
Firewall rules, limit public info
-
-
Honeypots, fake data
-
Weaponization
Threat intelligence feeds
-
-
-
-
-
Delivery
Email filtering, IDS alerts
Block malicious domains
Quarantine attachments
-
Phishing simulations
-
Exploitation
EDR, exploit detection
Patching, app whitelisting
DEP, ASLR
Sandboxing
Honeytokens
-
Installation
File integrity monitoring
Application control
-
-
Fake admin accounts
Endpoint isolation
C2
Network traffic analysis
Block C2 domains
Sinkhole DNS
Rate limiting
Decoy C2 servers
Network segmentation
Exfiltration
DLP, transfer monitoring
Encryption, access controls
Kill connections
Bandwidth limits
Watermarked data
Isolate compromised systems
You don’t need to memorize this entire table. The key insight is that defenders have options at every phase. The more layers you deploy, the harder it becomes for an attacker to complete the chain.
