The Cyber Kill Chain

Attacks are not one event — they are a sequence

When people picture a cyber attack, they imagine a single dramatic "hack". The reality is calmer and far more useful to understand: an attack is a sequence of steps, each one setting up the next. Security teams borrowed a military idea and named this sequence the Cyber Kill Chain.

Think of a burglar: first they watch the house, then find an unlocked window, climb in, disable the alarm, take the valuables, and leave. Miss any step — the window is locked, the alarm holds — and the burglary fails.

Why defenders love this idea

Here is the beautiful part. The attacker must complete every step to succeed. The defender only has to break one. That asymmetry is a huge advantage, and it is the whole point of the model: find the link you can break.

Flag: ASEC{break_one_link}

The seven phases

The best-known version, from Lockheed Martin, breaks an intrusion into 7 phases, from the attacker's first research to their final goal.

1. Reconnaissance — research the target (the very first phase, before any weapon is built).
2. Weaponization — build the malicious payload.
3. Delivery — send it (email, USB, a booby-trapped website).
4. Exploitation — trigger the vulnerability so the code runs.
5. Installation — install a backdoor to stay.
6. Command & Control — remotely steer the machine.
7. Actions on Objectives — steal, destroy, or spread.

So there are 7 phases, and the first one — before any payload exists — is Reconnaissance.

Why learn the order

Because knowing *where* in the chain an attacker is tells you what they will probably do next, and which defence is most useful right now.

From research to a foot in the door

Let's make the first four phases concrete with a story you have probably seen in the news: a phishing attack.

• Reconnaissance — the attacker browses LinkedIn and the company website to learn who works there and what software they use.
• Weaponization — they build a malicious document, hiding code inside what looks like a normal invoice.
• Delivery — they email it to an employee. Email is the most common delivery method, and a fake message like this is called phishing.
• Exploitation — the moment the employee opens the file, the hidden code runs, and the attacker has a foothold.

Why a defender cares

Notice how many of these steps involve a *person*. Training staff to spot phishing and filtering suspicious email breaks the chain at Delivery — before any code ever runs.

Flag: ASEC{phishing_is_delivery}

From foothold to full control

The attacker is in. The final three phases are about staying in and achieving their goal.

• Installation — they install a backdoor so they keep access even if the original hole is later closed.
• Command & Control (C2) — the backdoor quietly "phones home" to the attacker's server, asking for orders. This channel is called command and control.
• Actions on Objectives — finally, they do what they came for: steal data, deploy ransomware, or spread to other machines.

Why a defender cares

That C2 phone-home is a golden opportunity. A normal work computer does not usually make strange, regular connections to unknown servers. Watching outbound network traffic for these beacons is one of the best ways to catch an intrusion that is already inside.

Flag: ASEC{backdoor_phones_home}

Turn the chain into a checklist of defences

Here is where the kill chain earns its keep. Because an attack must pass through every phase, each phase is an opportunity to detect and stop it. Map a defence to each one and you have a real strategy instead of a random pile of tools.

For example, patching your software removes the vulnerability, which breaks the Exploitation phase — the attacker's weapon simply fizzles. Email filtering breaks Delivery, network monitoring catches Command & Control, and segmentation limits Actions.

The mindset shift

Instead of asking "do we have a firewall?", you ask "for each phase an attacker moves through, what stops them here?" Gaps jump out immediately.

Flag: ASEC{map_controls_to_phases}

Never rely on a single wall

No control is perfect. Firewalls get misconfigured, staff click bad links, patches lag behind. So instead of betting everything on one defence, you stack independent layers — if one fails, the next still protects you. This is defence in depth.

Picture a castle: a moat, then outer walls, then inner walls, then a guarded keep. An attacker who gets past one still faces the next. In security those layers are things like a perimeter firewall, network monitoring, endpoint protection, and strict access control around the data itself.

It pairs perfectly with the kill chain

Defence in depth and the kill chain fit together: the kill chain tells you *which* phases to cover, and defence in depth makes sure each is covered by more than one control.

Your flag for this task: ASEC{defense_in_depth}

When you need more detail

The kill chain is a brilliant big-picture map with seven phases. But real defenders often need finer detail — the exact *techniques* an attacker used. For that, the industry uses MITRE ATT&CK, a huge, constantly updated catalogue of attacker behaviour.

Where the kill chain has 7 broad phases, ATT&CK organises hundreds of specific techniques under a set of tactics (the attacker's goals). Each technique has a T-number you can look up, like T1566 for phishing. MITRE ATT&CK is the framework that maps these tactics and techniques.

How they work together

Think of the kill chain as the chapter titles and ATT&CK as the detailed index. Beginners start with the kill chain for the shape of an attack, then grow into ATT&CK for the specifics.

Flag: ASEC{attack_is_the_bigger_map}

Narrate an attack like a pro

You now have everything. Let's read a realistic breach through the kill chain and spot where a defender could have broken it.

1. Attackers scrape employee emails from LinkedIn — Recon.
2. They build a malicious spreadsheet — Weaponization.
3. They email it as a fake invoice — Delivery. *(Email filtering could stop it here.)*
4. An employee opens it and a macro runs — Exploitation. *(A patch or disabled macros could stop it here.)*
5. A backdoor is installed — Installation. *(Endpoint protection could catch it.)*
6. It beacons to a strange server — Command & Control. *(Network monitoring could flag it.)*
7. Customer data is stolen — Actions on Objectives. *(Segmentation could have limited the damage.)*

See how many chances the defender had? That is the entire lesson: an attack is a chain, every link is a chance, and detecting or stopping it at any single stage is the whole idea of the cyber kill chain.

Your graduation flag for this room: ASEC{you_understand_the_kill_chain}

Job-Ready Notes

Tools to know: a SIEM (Splunk / ELK), Sigma rules, MITRE ATT&CK, Zeek, Suricata.
Cheat sheet

index=main sourcetype=auth failed | stats count by src_ip   # brute-force hunt

Interview practice

• Walk me through triaging a SIEM alert.
• Explain true positive vs false positive.
• How do you use MITRE ATT&CK to drive detection?