Cyber Kill Chain

Reconnaissance(Recon)

The attacker investigates the target to identify weaknesses, gather intelligence on employees, and map the organization's network and technology stack

Weaponization

Using the intelligence gathered, the attacker builds or tailors a malicious payload (e.g., malware, malicious macros, or exploits) designed to target the identified weaknesses

Delivery

The attacker transmits the weaponized payload to the victim's environment, commonly via phishing emails, malicious website downloads, or compromised devices

Exploitation

The malicious code is triggered or executed on the target system, allowing the attacker to abuse a vulnerability and gain initial access

Installation

The attacker installs malware, backdoors, or Trojans on the compromised system to establish persistent access that survives system reboots

Command and Control (C2)

The installed malware establishes an outbound communication channel back to the attacker's infrastructure, allowing them to remotely manage the compromised system and explore the network

Actions on Objectives

Having fully penetrated the network, the attacker takes action to achieve their ultimate goal, such as exfiltrating sensitive data, encrypting files for ransom, or causing operational disruption