The Cyber Kill Chain: Seven Phases and Their Limits

Before 2011, a lot of security work treated intrusions as events. Something bad happened, it was cleaned up, and the next thing that happened was treated as unrelated.

The Lockheed Martin paper that introduced the cyber kill chain made a different argument: intrusions are campaigns with a repeatable structure, an attacker has to complete every step of that structure to succeed, and a defender only has to break one of them. That reframing is why the model spread. It moved the defensive question from "how do we stop the exfiltration" to "which of the seven steps before it can we break".

This guide covers the seven phases and what a defender does at each, the courses of action matrix that turns the model into a plan, and the specific places where a model written for perimeter-delivered malware does not fit intrusions today.

Scope: MITRE ATT&CK Framework Explained owns the technique taxonomy, Incident Response 101 owns response, and Lateral Movement Explained owns what happens between hosts. This page owns the model.

The seven phases

1. Reconnaissance

Selecting and researching a target. Public sources: employee names and roles, email address formats, technologies mentioned in job listings, exposed infrastructure in certificate transparency logs and DNS records, code and credentials in public repositories. Active scanning of the perimeter where the attacker accepts the noise.

What a defender sees. Very little of the passive part, by construction, since reading a public LinkedIn page generates no signal on your network. Active scanning shows in perimeter logs and is drowned in the constant background scanning of the internet.

What a defender does. Reduce what is available: minimise metadata in published documents, keep DNS records tidy, monitor certificate transparency for hostnames you did not intend to publish, and scan yourself so you know your own exposed surface. OSINT Reconnaissance Guide and Port Scanning Explained cover both sides.

2. Weaponization

Pairing a payload with something deliverable: a macro-enabled document, a malicious LNK file, an ISO or archive carrying a loader, an installer bundled with a legitimate application.

What a defender sees. Nothing. This happens entirely on the attacker's infrastructure. It is the one phase with no direct defensive action, and its value in the model is analytical: samples recovered later reveal tooling and build artifacts that link separate intrusions to one actor.

3. Delivery

Getting the weaponized object to the target. Phishing email, a compromised website, a malicious advertisement, removable media, a supply chain update, or a direct attack on an exposed service.

What a defender sees. A great deal, which is why this is the highest-value phase to invest in. Email security, attachment detonation, DNS filtering, web proxies and network detection all operate here.

What a defender does. Block the delivery mechanism. Strip or sandbox risky attachment types, disable macros from the internet, filter newly registered domains, and mark external email clearly. What Is Phishing and Email Security Guide cover this phase in depth, and HTML Smuggling covers the technique that exists specifically to get past this layer.

4. Exploitation

Triggering execution on the target. A software vulnerability, or a user persuaded to enable content, run an installer, or paste a command into a terminal.

What a defender sees. Exploit attempts in EDR telemetry, unusual process ancestry (a browser or an office application spawning a shell), and crash artifacts.

What a defender does. Patch, which is why Vulnerability Management Lifecycle matters at this phase. Enable exploit mitigations, covered in Exploit Mitigations Explained. Remove local administrator rights so exploitation yields less. Restrict script interpreters and macro execution.

5. Installation

Establishing persistence so the access survives a reboot and the user logging out. Registry run keys, scheduled tasks, services, WMI subscriptions, startup folders, or a web shell on a server.

What a defender sees. This is where EDR is strongest, because persistence writes to a small number of well-known places. Malware Persistence Techniques enumerates them.

What a defender does. Alert on new persistence, particularly a new service or scheduled task on a server. Application control, so unapproved binaries cannot execute at all.

6. Command and control

Opening a channel between the implant and the operator. HTTPS to a compromised or attacker-controlled site, DNS tunnelling, a legitimate cloud service used as a dead drop, or a mail-based channel.

What a defender sees. Beaconing patterns, meaning regular callbacks with consistent intervals and sizes. Unusual destinations, newly registered domains, and volumes of DNS traffic that do not match browsing behavior.

What a defender does. Egress filtering so only approved paths leave the network at all, DNS logging and filtering, TLS inspection where policy allows, and beacon detection. Command and Control Explained and DNS Tunneling Explained cover the mechanisms.

This is a strong phase for defense because the attacker must communicate, repeatedly, over time.

7. Actions on objectives

Whatever the intrusion was for: collecting and exfiltrating data, deploying ransomware, committing fraud, or maintaining long-term access for later.

What a defender sees. Large or unusual data movements, access to sensitive stores by accounts that never touch them, mass file modification, shadow copy deletion, backup tampering.

What a defender does. Data loss prevention, covered in What Is DLP, segmentation so a single compromise cannot reach everything, and backups that an attacker with domain rights cannot reach, covered in 3-2-1 Backup Strategy.

Note the gap that later models exist to fill: the original chain jumps from establishing control to achieving objectives, and says nothing about the internal reconnaissance, privilege escalation and lateral movement that occupy most of the attacker's actual time inside a network.

The courses of action matrix

The paper's most directly usable contribution is a grid: phases as rows, defensive actions as columns.

Phase	Detect	Deny	Disrupt	Degrade
Reconnaissance	Web and perimeter logs	Reduce public exposure	Rate limiting	Noise in public data
Delivery	Email gateway, proxy logs	Attachment filtering	Sandbox detonation	Attachment rewriting
Exploitation	EDR, process ancestry	Patching	Exploit mitigations	No local admin
Installation	EDR persistence alerts	Application control	Automated isolation	Restricted write paths
Command and control	Beacon detection, DNS logs	Egress filtering	Sinkholing	Proxy inspection
Actions on objectives	DLP, volume anomalies	Segmentation	Session termination	Rate-limited transfer

The original also lists deceive and destroy. Deception, meaning honeypots, canary tokens and decoy files, is genuinely useful and under-used: a document nobody should ever open, wired to an alert, detects the collection phase with almost no false positives.

Fill this grid in for your own environment and the empty cells are your gaps. That exercise is worth more than the phase list itself.

Kill chain and ATT&CK

They answer different questions and the comparison is worth being precise about.

	Cyber kill chain	MITRE ATT&CK
Shape	7 ordered phases	14 enterprise tactics, hundreds of techniques
Claim	Intrusions progress through stages	Adversaries use these observed behaviors
Order	Sequential by design	Not sequential
Granularity	Strategic narrative	Specific procedures
Best for	Explaining structure, planning layers	Detection coverage, actor description

They coexist comfortably. The kill chain is what you draw for an executive briefing to explain that an intrusion had six steps before the visible one. ATT&CK is what you map detections to, because "we detect T1053.005" is a testable claim and "we cover installation" is not.

The Diamond Model is the third piece of the classic trio, describing every intrusion event as a relationship between an adversary, a capability, some infrastructure and a victim. It is orthogonal to both: the kill chain says when, ATT&CK says how, and the Diamond Model says who and with what.

Where it breaks

Being specific about the limits is what keeps the model useful.

Credential-based intrusions skip most of it. An attacker who buys a valid password from an infostealer log, signs in to a SaaS application, and downloads a customer database has performed no weaponization, no delivery, no exploitation and no installation. Four of seven phases are absent, and the phases the model tells you to defend are not on the path. What Is an Infostealer covers the supply side of this, and it is now one of the most common intrusion shapes.

It is malware-centric. Living-off-the-land intrusions using built-in administrative tools produce no installation phase in the sense the model intends.

It is linear. Real intrusions loop: fresh reconnaissance from inside, new delivery to a second host, repeated exploitation as they move. Phases run in parallel on different machines. Treating the chain as a straight line under-describes what an incident responder actually sees.

It stops at the perimeter. Everything after the first host, which is most of the intrusion, is compressed into two phases. The Unified Kill Chain addresses exactly this, extending to 18 phases across three stages covering getting in, moving through, and acting on objectives.

It says nothing about insiders. Someone who already has access performs none of the first five phases.

It assumes a perimeter. With SaaS, cloud and remote work, the boundary the model was written against is thinner than it was, which is the reasoning behind Zero Trust Architecture Explained.

The verdict

The kill chain's durable contribution is the argument, rather than the seven boxes: an intrusion is a sequence, the attacker must complete all of it, and the defender only has to break one link. That is the case for layered defense stated in a form people act on.

Use it for structure and communication, use ATT&CK for detection engineering and actor description, and use the courses of action matrix to find out where your controls actually sit. And read the phases as a checklist of opportunities rather than as a claim that intrusions proceed tidily from one to seven, because they do not.

Related guides

• MITRE ATT&CK Framework Explained
• Incident Response 101
• Lateral Movement Explained
• Command and Control Explained
• Threat Hunting Guide