Cyber Kill Chain

Why it matters

It predates MITRE ATT&CK by two years and is still widely referenced, especially in vendor material, board decks and incident reports, so it is worth recognising even if your day-to-day tagging uses ATT&CK technique IDs. Its central idea has aged well: an attacker must complete every stage to succeed, so the defender only has to break one — and the earlier the better, because each later stage costs more to unwind.

The seven stages, and how it differs from ATT&CK

1. Reconnaissance — research the target: staff on LinkedIn, exposed services, technology in job ads.
2. Weaponization — build the payload: a macro document, an exploit bundled with a backdoor. Happens on the attacker's side; invisible to you.
3. Delivery — get it there: phishing e-mail, USB drop, watering-hole site.
4. Exploitation — trigger it: the macro runs, the vulnerability is exploited.
5. Installation — establish persistence: a service, a scheduled task, a web shell.
6. Command & Control — open the channel home (see C2).
7. Actions on Objectives — the actual goal: exfiltration, encryption, fraud.

The Kill Chain and ATT&CK get used interchangeably and they are not the same tool. The Kill Chain is a linear seven-stage narrative — good for explaining an incident's overall shape to a non-technical audience and for asking "where could we have stopped this?". ATT&CK is a much larger, non-linear catalogue of specific techniques within tactics roughly analogous to the Kill Chain's stages — good for precise detection engineering. Kill Chain for the story, ATT&CK for the detail.

The standard critiques: it is perimeter- and malware-centric (an insider or a stolen credential skips the first five stages), real intrusions loop and branch rather than proceeding in order, and it says nothing about what happens after the first objective (lateral movement, second objectives). The Unified Kill Chain (2017) merges it with ATT&CK into 18 phases to answer those.

Related terms

• MITRE ATT&CK — MITRE ATT&CK is a public, curated catalogue of the behaviours real attackers use, organised so defenders can say "we saw T1059.001" instead of "some PowerShell thing".
• TTP — TTPs are the three levels at which attacker behaviour is described — the tactic is why (steal credentials), the technique is how (dump LSASS memory), the procedure is exactly how this actor does it (procdump renamed to dump64.exe, run via a scheduled task).
• C2 — C2 (Command and Control) is the channel an attacker uses to remotely control compromised hosts — send commands, pull data, push new tools — after the initial compromise.
• Red / Blue / Purple Team — Red team attacks (or simulates attacking), blue team defends and detects, purple team is the deliberate practice of doing both together so the detection gap gets closed instead of just documented.