Intelligence

What is Kill chain?

Lockheed Martin's seven stage model of an intrusion as a sequence, used to work out how far an attack got before you saw it.

The Cyber Kill Chain is Lockheed Martin's seven-stage model of an intrusion: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, and actions on objectives. It was published in 2011.

The model is useful for asking how far an attack got before it was seen and where it could have been stopped earlier. Its limits are that real intrusions loop and skip stages, and that it says little about what happens inside the network after the first foothold, which is why many teams pair it with MITRE ATT&CK.

Where you learn it

See Kill chain in a real investigation

Our missions put you in front of real logs, domains and forums, with these terms underlined where they appear.

Start learning free