📖 What is Cyber Kill Chain?
The Cyber Kill Chain is a framework developed by Lockheed Martin that outlines the stages of a cyberattack from reconnaissance to the final objective. It helps analysts identify the point at which an attack can be disrupted to prevent a successful breach.
"Focus on the linear nature of this model. Breaking any single link in the chain effectively prevents the attacker from completing their ultimate objective."
📚 Certification: CompTIA Cybersecurity Analyst+ (CS0-003)
🔑 What are the Key Concepts of Cyber Kill Chain?
- ▸ The model follows a linear progression where attackers must successfully complete each sequential stage to achieve their final objective.
- ▸ Breaking the chain at any single point effectively disrupts the entire attack, preventing the adversary from reaching the final goal.
- ▸ Reconnaissance and Weaponization occur primarily on the attacker's side, making them the most difficult phases for defenders to detect.
- ▸ Command and Control (C2) establishes a communication channel, allowing the attacker to remotely manage the compromised system and issue commands.
- ▸ Actions on Objectives is the final phase where the attacker fulfills their purpose, such as data exfiltration or deploying ransomware.
🎯 How does Cyber Kill Chain appear on the CS0-003 Exam?
You may be asked to identify the current stage of an attack when an analyst discovers a system beaconing to an unknown external IP address.
A scenario might describe an attacker searching social media for employee roles and performing port scans; you must categorize this as the Reconnaissance phase.
Expect questions where you must determine the most effective point to 'break the chain' after a phishing email has landed in a user's inbox.
❓ Frequently Asked Questions
How does the Cyber Kill Chain differ from the MITRE ATT&CK framework?
The Kill Chain is a high-level linear model focusing on the stages of an attack, while MITRE ATT&CK is a detailed matrix of specific techniques used within those stages.
Can an attacker skip stages in the Cyber Kill Chain?
In the formal Lockheed Martin model, the stages are sequential. However, in real-world scenarios, some phases may overlap or be combined depending on the exploit used.
Why is the Weaponization phase so difficult for analysts to detect?
Weaponization happens on the attacker's own infrastructure where they couple an exploit with a backdoor, meaning no activity occurs on the victim's network yet.