Cyber Kill Chain: The 7 Stages and How to Break Each One

The cyber kill chain is a seven-stage model of how a targeted intrusion unfolds: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives. Lockheed Martin researchers Eric Hutchins, Michael Cloppert and Rohan Amin introduced it in a 2011 paper on intelligence-driven defense. The idea is that an attacker has to complete every stage to succeed, so defenders who detect, deny or disrupt any single stage can break the attack. Today it is best used for explaining and planning defenses, alongside the more detailed MITRE ATT&CK framework.

Key facts:

• Origin: Hutchins, Cloppert and Amin, "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains," Lockheed Martin, 2011. Cyber Kill Chain® is a Lockheed Martin registered trademark.
• Stages: seven, from reconnaissance to actions on objectives. Some vendors add an eighth stage, but the original paper has seven.
• Defender actions: the paper maps each stage to six courses of action: detect, deny, disrupt, degrade, deceive and destroy.
• Main limits: it was built around external, malware-driven intrusions, so insider, identity and cloud attacks fit it poorly. The Unified Kill Chain and MITRE ATT&CK address those gaps.

What Is the Cyber Kill Chain?

The term comes from military targeting. The Lockheed Martin paper explains that U.S. military doctrine describes a kill chain as find, fix, track, target, engage and assess, and calls it a "chain" because a failure at any step interrupts the whole process. The authors applied the same logic to computer intrusions: an attacker has to build a payload, get it across a trusted boundary, establish a presence inside, and only then act on the real goal.

The original 2011 paper was written for defenders facing advanced persistent threats (APTs), well-resourced groups that run multi-year espionage campaigns. Its central argument is about the defender's advantage. In the paper's words, "just one mitigation breaks the chain and thwarts the adversary," and because APT groups try again and again, every tool, domain or technique they reuse is a liability defenders can exploit. Lockheed Martin still presents the model on its Cyber Kill Chain page as a framework for identifying and preventing intrusion activity.

The model is more than a list of stages. The paper describes three practices that make it useful:

• Courses of action: for each stage, decide how you can detect, deny, disrupt, degrade, deceive or destroy the attacker's activity.
• Intrusion reconstruction: when you detect an attack at one stage, reconstruct the earlier stages too. If you only learn about the exploit, you cannot block the next delivery attempt.
• Campaign analysis: link separate intrusions through shared indicators, such as reused infrastructure or tooling, so you can defend against the next attempt before it arrives.

That last point is easy to miss. The paper argues that a new zero-day exploit is only one change in a longer process. If the attacker reuses detectable tools or infrastructure at other stages, the new exploit gains them nothing.

The 7 Stages of the Cyber Kill Chain

The table below follows the definitions in the Lockheed Martin paper, with a present-day example for each stage.

1. Reconnaissance

The attacker researches the target. The paper's examples are crawling conference proceedings and mailing lists for email addresses, relationships and technology details. Today that includes social media, job postings, code repositories, certificate logs and internet-wide scans for exposed services. Most of this activity happens outside your network, so you see little of it directly.

Defender actions: reduce what attackers can learn. Inventory your internet-facing assets, remove stale services, and limit what job ads and public profiles reveal about your technology stack. Watch for lookalike domains that may be used later in phishing. Where you do see scanning in web or firewall logs, keep it, because it may become a campaign indicator.

2. Weaponization

The attacker builds the payload. In the paper's era that usually meant pairing a remote access trojan with an exploit inside a PDF or Office document. Today it can also mean a phishing kit, a credential-harvesting page or an exploit for an internet-facing application.

Defender actions: you cannot see this stage happen, but you can study its output. Analyze malicious files and kits you catch to learn the tooling, builders and metadata an adversary reuses, and turn those artifacts into detections. Threat intelligence on the groups that target your sector tells you which payload types to expect.

3. Delivery

The attacker sends the weapon. The paper notes that Lockheed Martin's incident response team saw email attachments, websites and USB media as the three most common APT delivery vectors from 2004 to 2010. Email remains central, but delivery can also be a crafted request sent straight to a vulnerable server, with no user involved.

Defender actions: this is the first stage you can block reliably. Filter and sandbox email attachments and links, block risky file types, restrict removable media, and put internet-facing applications behind a web application firewall. Train and reward users for reporting suspicious messages: the paper's own matrix lists the "vigilant user" as a delivery-stage detection. Our guide to social engineering attacks covers the human side of delivery in depth.

4. Exploitation

The payload runs. The paper notes that exploitation usually targets an application or operating system vulnerability, but it can also exploit the user directly or abuse a feature that runs code automatically.

Defender actions: patch, prioritizing vulnerabilities known to be exploited, such as those in CISA's Known Exploited Vulnerabilities catalog. Enable exploit protection and endpoint detection and response (EDR), disable macros and auto-run features you do not need, and use multi-factor authentication so a stolen password alone is not enough.

5. Installation

The attacker installs something that survives a reboot or a password change, such as a backdoor, web shell, scheduled task, service or new account.

Defender actions: application allowlisting, file integrity monitoring on web server directories, EDR rules for new persistence mechanisms, and alerts on new or changed privileged accounts. This stage leaves artifacts on your systems, which makes it one of the best places for detection.

6. Command and Control (C2)

The compromised host connects back to the attacker. Once that channel works, the paper notes, intruders have "hands on the keyboard" inside the environment.

Defender actions: restrict outbound traffic so servers can only reach what they need, filter DNS, route web traffic through a proxy, and hunt for regular beaconing patterns and connections to newly registered domains. The paper's matrix also lists deception at this stage, such as redirecting known C2 domains to a sinkhole.

7. Actions on Objectives

Only now does the attacker work toward the real goal. The paper names data exfiltration as the typical objective, notes that integrity or availability attacks are possible too, and adds that intruders may simply use the first host as a hop point to move laterally through the network.

Defender actions: limit the damage a foothold can do. Segment the network, enforce least privilege, monitor for credential theft and lateral movement, watch for large or unusual outbound transfers, keep tested offline backups, and plant canary files or honeypots to catch attackers searching for data. An incident response plan decides how quickly a detection here turns into containment.

Defender Actions per Stage: The Courses of Action Matrix

The paper's Table 1 is a "courses of action" matrix. It uses six actions from U.S. Department of Defense information operations doctrine: detect, deny, disrupt, degrade, deceive and destroy. For the exploitation stage, for example, the paper explains that a host intrusion detection system can detect the exploit, patching denies it altogether, and data execution prevention can disrupt it once it starts. Its examples reflect 2011 tooling, such as network intrusion detection, firewall access lists, proxies, in-line antivirus, tarpits and honeypots.

The matrix below applies the same idea to current controls. It is DeepStrike editorial guidance, not a reproduction of the paper's table. We have dropped "destroy," which in an enterprise usually means taking down attacker infrastructure through law enforcement or a provider, not something a security team does itself.

Two practical rules follow from the matrix. First, layer controls across several stages rather than betting on one. A zero-day defeats patching, but the same intrusion can still be caught at installation or C2. Second, the later stages happen on systems you control, so they usually offer the most reliable detection opportunities.

A Real Campaign Through the Kill Chain: CL0P and MOVEit (2023)

The FBI and CISA described this campaign in joint advisory AA23-158A, released June 7, 2023 and updated June 16, 2023. According to the advisory, beginning on May 27, 2023, the CL0P ransomware gang, also tracked as TA505, exploited a previously unknown SQL injection vulnerability in Progress Software's MOVEit Transfer, a managed file transfer application. The flaw is CVE-2023-34362, and CISA added it to the Known Exploited Vulnerabilities catalog on June 2, 2023.

The table maps what the advisory reports to the seven stages. Where the advisory is silent, the table says so instead of guessing.

Three lessons stand out.

The stages can collapse into one step. Delivery, exploitation and installation all happened through web requests to one exposed server. No phishing email, user click or lateral movement was needed to reach the data, because the data sat behind the compromised application. A model that pictures a long, visible progression can make defenders underestimate how compressed a real chain can be.

A zero-day removes a stage, not the whole chain. Patching could not deny exploitation before a fix existed. The other stages still offered chances: limiting the server's exposure, spotting a new .aspx file in the web directory, catching a new administrator account, or noticing large downloads. The advisory adds a warning that matters for recovery: if a victim rebuilds the web server but leaves the database intact, the attacker-created accounts can still provide persistent access. It includes a database query for auditing active administrator accounts.

Campaign analysis would have helped. This was the third time in about three years that the advisory links TA505 to a zero-day campaign against a managed file transfer product. That is exactly the kind of pattern the 2011 paper tells defenders to track. An organization tracking it could have prioritized monitoring and exposure reduction for its own file transfer servers before May 2023.

Criticisms and Limits of the Cyber Kill Chain

The kill chain is still useful, but it has well-known weaknesses. Most of them come from the threat it was designed for: external APT groups delivering malware across a network perimeter.

It is perimeter- and malware-focused

Paul Pols' Unified Kill Chain white paper puts it directly: research shows the traditional model "is perimeter- and malware-focused" and fails to cover attacks that occur behind the organizational perimeter. Five of the seven stages describe getting in and setting up a foothold. Everything an attacker does after the first foothold, including discovery, privilege escalation, credential theft and lateral movement, is compressed into "actions on objectives," which is where modern ransomware operators spend most of their time.

Insider threats skip most of the chain

A malicious insider already has access. There is no reconnaissance of the perimeter, no weaponized payload, no exploit and often nothing to install. The first visible step may be an employee downloading data they are allowed to read. The 2011 paper itself notes that separate phase-based models had been proposed for insider threats, which signals that its own model was not built for them. Detecting insiders depends on least privilege, monitoring of data access and behavior, and strong offboarding, not on breaking an intrusion chain.

Cloud and identity attacks rarely need malware

In cloud and software-as-a-service environments, the attacker often steals an identity rather than compromising a machine. CISA and the FBI's advisory on Scattered Spider, AA23-320A (first published November 16, 2023), describes a group that used phishing, SIM swapping and social engineering of IT help desk staff to get passwords and MFA tokens reset. The actors then registered their own MFA devices, added a federated identity provider to the victim's single sign-on tenant, used legitimate remote access tools, and moved into Amazon EC2 instances.

Mapped to the kill chain, there is no weaponized payload and no exploit, and "installation" becomes a new MFA device or identity provider. The defenses that matter are phishing-resistant MFA, strict help desk identity verification and alerts on identity configuration changes, which the classic matrix barely mentions.

Real attacks are not linear

The kill chain implies a fixed sequence. The Unified Kill Chain research reports that its case studies "falsify a crucial assumption" of traditional kill chain models, namely that attackers must pass through each phase in a fixed order. Attackers skip stages, repeat them and loop back. A team that concentrates every control on stopping attacks at the earliest stage may be left with nothing when that stage is bypassed.

What to do about the limits

None of this makes the model useless. It means you should pair it with an assume-breach mindset: plan detection for activity inside the network as carefully as for the perimeter, extend the "actions on objectives" stage with internal stages such as discovery, privilege escalation and lateral movement, and add identity events to the matrix. A detailed behavior catalog such as MITRE ATT&CK fills in what the seven stages leave out.

The Unified Kill Chain in Brief

The Unified Kill Chain (UKC) was developed by Paul Pols, first published in December 2017 in his master's thesis at Leiden University, and later released as a white paper with Fox-IT acknowledged. Its website says it extends and combines Lockheed Martin's Cyber Kill Chain and MITRE ATT&CK, and that it is released under the GNU GPL v2.

The UKC has 18 phases grouped into three stages of an attack:

• In (gaining an initial foothold): Reconnaissance, Resource Development, Delivery, Social Engineering, Exploitation, Persistence, Defense Evasion, Command and Control
• Through (hacking through the network): Pivoting, Discovery, Privilege Escalation, Execution, Credential Access, Lateral Movement
• Out (acting on objectives): Collection, Exfiltration, Impact, Objectives

The UKC's main improvements are that it models social engineering and pivoting explicitly, covers attacks on integrity and availability, and treats getting in and moving through the network as loops an attacker may repeat, rather than a one-way sequence. If you need more than seven stages but less than the full ATT&CK catalog, it is a useful middle ground.

Cyber Kill Chain vs MITRE ATT&CK

The two models answer different questions. The kill chain describes the stages of an intrusion at a high level. MITRE ATT&CK catalogs the specific behaviors attackers use, organized by tactic, with technique IDs and real-world examples. ATT&CK v20, released in October 2026, has 15 Enterprise tactics and hundreds of techniques. Our MITRE ATT&CK framework guide covers its structure, the current tactics and a three-way comparison with the kill chain and MITRE D3FEND, so this section focuses on how the two models line up.

This mapping is approximate DeepStrike editorial guidance, not a MITRE publication. Note how much of ATT&CK lands in the kill chain's last stage. That is the post-compromise gap described above.

In practice, the two work best together. Use the kill chain to tell the story of an attack to executives and to check that you have controls at every stage. Use ATT&CK to describe exactly what happened, write detections and track coverage. Many government advisories, including AA23-158A, already map attacker activity to ATT&CK techniques. For example, the MOVEit exploitation appears there as Exploit Public-Facing Application (T1190), and the LEMURLOOT web shell corresponds to Server Software Component: Web Shell (T1505.003).

How Red Teams Use the Cyber Kill Chain

A red team engagement emulates a realistic adversary pursuing a specific objective, then measures whether the organization prevented, detected and responded to it. The kill chain gives that work a simple structure.

Planning the scenario backward from the objective

Red teams usually start at stage 7. They agree with the client what a realistic attacker would want, such as access to payment systems, a domain administrator account or a set of sensitive files, and then plan the earlier stages that would lead there. The adversary profile decides where the chain starts. An external attacker begins at reconnaissance; a compromised vendor or a rogue insider may begin at installation or even actions on objectives. Starting partway through the chain is called an assumed-breach test, and it is the honest way to test insider and post-compromise scenarios that the classic model handles poorly. An internal penetration test uses the same starting point with a narrower scope.

Measuring where the chain broke

The most useful kill chain metric from an exercise is where defenders first noticed the attack and where they stopped it. A simple results table records, for each stage, what the team did, whether it was prevented, detected or missed, and how long detection and response took. An exercise that is detected only at exfiltration tells a very different story from one that is blocked at delivery, even if both end with a fixed vulnerability. This measurement approach is DeepStrike editorial guidance, not part of the original paper.

Reporting in two languages

Kill chain stages work well in the executive summary: "the attacker got in through a phishing email, kept access with a scheduled task, and reached the file server before anyone noticed." The technical sections then use ATT&CK technique IDs, timestamps and hosts so defenders can find each action in their logs.

Replaying stages with the blue team

After the exercise, a purple teaming session replays the stages where the attack went unnoticed, one at a time, while defenders tune detections and retest. Working stage by stage keeps the session focused on the biggest gaps.

Keeping it safe

Red teams work under written rules of engagement. They use harmless payloads, canary data instead of real sensitive data, agreed deconfliction contacts and clear limits on what may be touched. Weaponization in an authorized exercise means building a safe, controlled test payload, never live malware.

Common Mistakes When Using the Kill Chain

• Investing only in the early stages. Perimeter controls matter, but zero-days, stolen credentials and insiders bypass them. Make sure installation, C2 and actions on objectives have detections too.
• Treating "actions on objectives" as one stage. Break it into discovery, privilege escalation, credential access, lateral movement, collection and exfiltration when you plan detections.
• Skipping intrusion reconstruction. Detecting one stage is not enough. Work backward to the delivery method and infrastructure so you can block the next attempt.
• Forgetting identity. Add help desk resets, MFA registrations and identity provider changes to your matrix.
• Assuming a linear attack. Plan for skipped, repeated and looping stages.

Frequently Asked Questions

Who invented the cyber kill chain?

Lockheed Martin researchers Eric M. Hutchins, Michael J. Cloppert and Rohan M. Amin introduced the intrusion kill chain in their 2011 paper "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains." They adapted the military targeting concept of a kill chain to computer intrusions.

What are the 7 stages of the cyber kill chain?

Reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives. The attacker researches the target, builds a payload, sends it, triggers it, installs persistent access, opens a remote control channel and then pursues the goal, such as stealing data.

Is there an eighth stage of the cyber kill chain?

Not in the original model. The 2011 paper defines seven stages. Some vendors add an eighth, such as monetization, to describe how criminals cash in, but that is an extension, not part of Lockheed Martin's model.

What is the difference between the cyber kill chain and MITRE ATT&CK?

The kill chain is a high-level, seven-stage model of an intrusion. MITRE ATT&CK is a detailed knowledge base of attacker behavior with 15 Enterprise tactics in v20 and hundreds of techniques based on real reporting. The kill chain is good for explaining an attack and checking controls stage by stage; ATT&CK is better for writing detections, mapping incidents and planning emulation.

Can you give an example of the cyber kill chain?

The 2023 CL0P campaign against MOVEit Transfer is a good example. The group prepared an exploit and the LEMURLOOT web shell, sent malicious requests to internet-facing MOVEit servers, exploited a SQL injection flaw (CVE-2023-34362), installed the web shell, controlled it over HTTP and stole data for extortion, according to FBI and CISA advisory AA23-158A.

Is the cyber kill chain still relevant?

Yes, as a way to explain attacks and organize layered defenses. Its weak points are insider threats, identity and cloud attacks and the post-compromise phase, so most teams pair it with MITRE ATT&CK or use the Unified Kill Chain for more detail.

What is the Unified Kill Chain?

The Unified Kill Chain, developed by Paul Pols and first published in 2017, extends the Lockheed Martin model with ideas from MITRE ATT&CK. It has 18 phases in three groups, In, Through and Out, and adds stages such as social engineering, pivoting, discovery and lateral movement.

What does "actions on objectives" mean?

It is the final stage, where the attacker does what they came for. That is usually stealing data, but it can also be encrypting or destroying systems, or using the compromised host as a stepping stone to reach other systems.

Next Step: Find Out Where Your Kill Chain Breaks

A matrix of controls shows where you expect to stop an attacker. A realistic exercise shows where you actually do. Start by listing your detections and preventions for each stage, then test the stages where you have the least evidence.

DeepStrike's red teaming services run objective-driven engagements across people, identity, cloud, applications and internal trust boundaries. Adversary profiles include an external attacker, a rogue insider, a compromised third-party vendor and nation-state or APT group simulation, and access can start from the outside or from an assumed-breach position. Each engagement measures your SOC, alerting and response workflows against realistic tradecraft and ends with attacker pathways, evidence, remediation priorities and retest-ready next actions. To scope an exercise around the threats you face, contact DeepStrike.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements for Fortune 500 companies, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

• Hutchins, Cloppert and Amin, Lockheed Martin: Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains (2011)
• Lockheed Martin: Cyber Kill Chain
• FBI and CISA: AA23-158A, #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability (June 7, 2023)
• NIST National Vulnerability Database: CVE-2023-34362
• FBI and CISA: AA23-320A, Scattered Spider (November 16, 2023)
• Paul Pols: The Unified Kill Chain
• MITRE ATT&CK: Enterprise tactics
• MITRE ATT&CK: TA505 (G0092)
• MITRE ATT&CK: Server Software Component: Web Shell (T1505.003)
• Wikipedia: Cyber kill chain