> ## Documentation Index
> Fetch the complete documentation index at: https://stem-docs.intellectualpoint.com/llms.txt
> Use this file to discover all available pages before exploring further.
# The cyber kill chain
> Follow an attack from start to finish through the seven phases of the Lockheed Martin Cyber Kill Chain.
## Understanding the attack lifecycle
Every cyberattack follows a pattern. In 2011, Lockheed Martin - the defense contractor - published a framework called the **Cyber Kill Chain** that maps the seven phases an attacker goes through from initial research to achieving their objective.
The kill chain is a defender's roadmap. If you understand every step an attacker must take, you can build defenses at each phase. Break any single link in the chain, and the entire attack fails.
The term "kill chain" comes from the military, where it describes the stages of an attack: find the target, fix the location, track movement, target with a weapon, engage, and assess results. Lockheed Martin adapted the concept for cybersecurity.
***
## The seven phases: RWDEICE
Use the mnemonic **RWDEICE** to remember the phases: **R**econnaissance, **W**eaponization, **D**elivery, **E**xploitation, **I**nstallation, **C**ommand and Control, **E**xfiltration (Actions on Objectives).
**What happens:** The attacker researches their target before launching any attack. They collect information about the organization, its people, its technology, and its defenses.
**Techniques used:**
* **OSINT (Open Source Intelligence):** Searching public records, websites, social media profiles
* **DNS lookups:** Finding domains, subdomains, and IP addresses
* **LinkedIn research:** Identifying employees, job titles, and technologies used
* **Google dorking:** Using advanced search operators to find exposed files or login pages
* **Port scanning:** Probing for open network ports and services
**Real-world example:** Before attacking a company, an attacker searches LinkedIn and finds a system administrator who lists "Cisco ASA firewall" and "Windows Server 2019" in their skills. Now the attacker knows exactly what technologies to target.
**What defenders can do:** Monitor for suspicious reconnaissance activity (port scans, unusual DNS queries). Limit what employees share publicly. Use honeypots to detect probing.
**What happens:** The attacker builds their weapon. They pair an **exploit** (the code that takes advantage of a vulnerability) with a **payload** (the malicious code that runs after the exploit succeeds).
**Techniques used:**
* Creating a malicious PDF, Word document, or spreadsheet
* Building a trojanized application
* Developing a custom exploit for a known vulnerability
* Purchasing exploit kits on the dark web
**Real-world example:** The attacker creates a Word document with a malicious macro. When the target opens it and clicks "Enable Content," the macro downloads and installs a backdoor.
**What defenders can do:** This phase happens entirely on the attacker's side, so you cannot directly prevent it. However, keeping your systems patched reduces the vulnerabilities an attacker can weaponize.
**What happens:** The attacker sends the weapon to the target. This is the first phase where the attacker interacts directly with the victim.
**Delivery methods:**
* **Email:** Phishing or spear-phishing with malicious attachments or links
* **Web:** Compromised websites (watering holes), malicious ads (malvertising)
* **Physical:** Infected USB drives left in parking lots (baiting)
* **Supply chain:** Compromising a trusted vendor or software update
**Real-world example:** In the Target breach, attackers sent a spear-phishing email to an employee at Fazio Mechanical - Target's HVAC vendor. The email contained malware that gave attackers credentials to Target's vendor portal.
**What defenders can do:** Email filtering, web proxies, endpoint detection, user awareness training. This is one of the most effective phases to stop an attack.
**What happens:** The weapon fires. The vulnerability is exploited, and malicious code begins executing on the target system. The attacker gains their initial foothold.
**How exploitation occurs:**
* A user opens a malicious attachment and a macro executes
* A user visits a compromised website and a drive-by download triggers
* A software vulnerability is exploited remotely (buffer overflow, SQL injection)
* A user plugs in an infected USB drive
**Real-world example:** The Target HVAC vendor employee opened the phishing email, and the malware exploited a vulnerability to steal their login credentials for Target's vendor management portal.
**What defenders can do:** Patch management (close vulnerabilities before they are exploited), application whitelisting, endpoint detection and response (EDR), Data Execution Prevention (DEP).
**What happens:** The attacker installs persistent access tools - backdoors, remote access trojans (RATs), rootkits, or web shells. The goal is to maintain access even if the initial vulnerability is patched or the user reboots.
**Tools installed:**
* **RATs (Remote Access Trojans):** Full remote control of the compromised system
* **Rootkits:** Hide deep in the OS to avoid detection
* **Web shells:** Backdoor scripts planted on web servers
* **Scheduled tasks:** Malicious code that re-launches itself on reboot
**Real-world example:** After gaining access through the vendor portal, the Target attackers installed malware on Point-of-Sale (POS) terminals across thousands of stores. This malware scraped credit card data from memory during every transaction.
**What defenders can do:** Endpoint detection, file integrity monitoring, application control, monitoring for unusual scheduled tasks or services.
**What happens:** The installed malware establishes a communication channel back to the attacker's server. This lets the attacker remotely control the compromised system, issue commands, and extract data.
**C2 techniques:**
* **Beaconing:** Malware periodically contacts the attacker's server for instructions
* **DNS tunneling:** Hiding C2 communication inside DNS queries
* **HTTPS:** Blending in with normal encrypted web traffic
* **Social media:** Using posts or comments on platforms as hidden command channels
**Real-world example:** The malware on Target's POS systems communicated back to attacker-controlled servers, sending batches of stolen credit card data at scheduled intervals.
**What defenders can do:** Network monitoring, DNS filtering, blocking known malicious domains, analyzing outbound traffic patterns for beaconing behavior.
**What happens:** The attacker achieves their goal. This is what the entire operation was building toward.
**Common objectives:**
* **Data theft:** Stealing confidential files, customer data, intellectual property
* **Ransomware deployment:** Encrypting all files and demanding payment
* **Destruction:** Wiping systems, corrupting data
* **Lateral movement:** Using the compromised system as a launching point to attack other internal systems
* **Espionage:** Ongoing surveillance and intelligence collection
**Real-world example:** The Target attackers exfiltrated over **40 million credit card numbers** and **70 million customer records** to servers in Eastern Europe. The breach cost Target over \$200 million.
**What defenders can do:** Data loss prevention (DLP), network segmentation, access controls, monitoring for large data transfers, incident response plans.
***
## Case study: the Target breach (2013)
The Target data breach is one of the most studied cyberattacks in history. Here is how it maps to every phase of the kill chain.
| Kill chain phase | What happened |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| **Reconnaissance** | Attackers identified Fazio Mechanical, a small HVAC company that had network access to Target for billing and project management |
| **Weaponization** | Attackers created a phishing email containing the Citadel banking trojan |
| **Delivery** | The phishing email was sent to Fazio Mechanical employees |
| **Exploitation** | A Fazio employee opened the email. The Citadel malware stole their Target vendor portal credentials |
| **Installation** | Attackers used the stolen credentials to access Target's network and installed POS-scraping malware on registers in 1,797 stores |
| **Command and control** | The POS malware communicated with attacker servers, sending stolen card data in batches |
| **Actions on objectives** | 40 million credit card numbers and 70 million customer records were exfiltrated to servers in Eastern Europe |
Several failures made this breach possible:
* **Network segmentation failure:** The HVAC vendor had access to the same network as the POS systems. These should have been completely separate.
* **Ignored alerts:** Target's FireEye security monitoring system actually detected the malware and sent alerts. The security team in Minneapolis did not act on them.
* **Vendor management:** A small HVAC company had direct network access to one of the largest retailers in the world without sufficient security requirements.
* **Delayed response:** The breach went undetected for nearly three weeks. Target learned about it from the U.S. Department of Justice, not from their own security tools.
* **\$18.5 million** settlement with 47 states
* **\$200+ million** total cost of the breach
* CEO and CIO both resigned
* Target's stock dropped significantly
* Led to widespread adoption of chip-and-PIN credit card technology in the U.S.
* Became a textbook case in cybersecurity education (including this camp)
***
## Why the kill chain matters for defenders
The kill chain is not just an academic model - it is a practical defense strategy.
An attacker must succeed at **every** phase. A defender only needs to stop **one**. If you block delivery, the exploit never fires. If you detect C2, you can cut the attacker off before they steal anything.
The earlier you stop an attack, the less damage it causes. Catching reconnaissance costs nothing. Responding to exfiltration costs millions.
No single security control stops every attack at every phase. You need defenses at **multiple** phases so that if one fails, the next catches it.
Knowing what phase attackers are in helps you predict their next move and respond appropriately.
***
## Defender actions by phase
For each phase of the kill chain, defenders can take six types of action.
| Phase | Detect | Deny | Disrupt | Degrade | Deceive | Contain |
| ------------------ | ------------------------------- | --------------------------------- | ---------------------- | ---------------- | -------------------- | --------------------------- |
| **Reconnaissance** | Web analytics, port scan alerts | Firewall rules, limit public info | - | - | Honeypots, fake data | - |
| **Weaponization** | Threat intelligence feeds | - | - | - | - | - |
| **Delivery** | Email filtering, IDS alerts | Block malicious domains | Quarantine attachments | - | Phishing simulations | - |
| **Exploitation** | EDR, exploit detection | Patching, app whitelisting | DEP, ASLR | Sandboxing | Honeytokens | - |
| **Installation** | File integrity monitoring | Application control | - | - | Fake admin accounts | Endpoint isolation |
| **C2** | Network traffic analysis | Block C2 domains | Sinkhole DNS | Rate limiting | Decoy C2 servers | Network segmentation |
| **Exfiltration** | DLP, transfer monitoring | Encryption, access controls | Kill connections | Bandwidth limits | Watermarked data | Isolate compromised systems |
You don't need to memorize this entire table. The key insight is that defenders have options at **every** phase. The more layers you deploy, the harder it becomes for an attacker to complete the chain.
***
## Exercise: map the kill chain
Read the following scenario and identify which kill chain phase each step represents.
1. An attacker finds that Costco employees use a specific HR portal for benefits enrollment.
2. The attacker builds a fake version of the HR portal with a login page that captures credentials.
3. The attacker sends an email to Costco employees: "Your benefits enrollment deadline is tomorrow - log in now to avoid losing coverage."
4. An employee clicks the link and enters their username and password on the fake site.
5. The attacker uses the stolen credentials to install a remote access tool on the HR server.
6. The remote access tool connects back to the attacker's server every 30 minutes for instructions.
7. The attacker downloads the entire employee database, including Social Security numbers and bank account details.
***
**Answers:**
1. **Reconnaissance** - researching the target's systems and habits
2. **Weaponization** - building the attack tool (fake portal)
3. **Delivery** - sending the phishing email
4. **Exploitation** - the victim's credentials are captured
5. **Installation** - establishing persistent access
6. **Command and control** - establishing the C2 channel
7. **Actions on objectives** - data exfiltration