[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What Is the Cyber Kill Chain and How to Use It Effectively](/blog/cyber-kill-chain) Publish date November 30, 2025 {x} minute read # What Is the Cyber Kill Chain and How to Use It Effectively [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) The cyber kill chain model outlines the stages of an attack by an [advanced persistent threat (APT)](https://www.upguard.com/blog/what-is-an-advanced-persistent-threat) or cybercriminal attempting to gain unauthorized access to sensitive data or assets within a security perimeter.  Understanding the seven stages of the cyber kill chain can help prevent a wide range of dangerous cyber threats. ## What are the Seven Phases of the Cyber Kill Chain? Below we briefly explain the stages of an attack according to the Lockheed Martin model. In each stage, we describe a brief list of attacks that could be used during the stage.  ### 1. Reconnaissance In the reconnaissance phase, cyber attackers are concerned with research, identification, and selection of targets. This is often achieved by crawling the Internet for conference attendees, email addresses, social media relationships, or information on target systems.   While many security professionals feel there isn't anything that can be done at this stage, we believe this is wrong.  Attackers take advantage of poor [operations security](https://www.upguard.com/blog/opsec), [open ports](https://www.upguard.com/blog/open-port), and the myriad of other externally observable [attack vectors](https://www.upguard.com/blog/attack-vector) to decide on their targets. Investing in [attack surface management software](https://www.upguard.com/product/breach-risk) can help you understand, map, and reduce your [attack surface](https://www.upguard.com/blog/attack-surface) over time. The reconnaissance stage is where secure behaviors can have a big impact. A security-conscious organization will know they are a potential target and limit what information they share, reducing the risk of [spear phishing](https://www.upguard.com/blog/spear-phishing) and [whaling attacks](https://www.upguard.com/blog/whaling-attack).  That's not to say detecting reconnaissance efforts in real-time isn't difficult. It is and these controls won't stop everything. However, discovering reconnaissance after the fact can still provide context into the intent of an attacker. Consider investing in the following detection mechanisms: * Collecting website visitor logs for altering and historical searching * Collaborating with web administrators to utilize their existing browser analytics * Building detections for browsing behaviors that are unique to reconnaissance * Prioritizing defenses around particular technologies or people based on reconnaissance activity ### 2. Weaponization The weaponization stage is the preparation and staging phase of a cyberattack. The attacker has still not interacted with its intended victim. Instead, they are creating their attack.  This typically means coupling [malicious software](https://www.upguard.com/blog/malware), like a remote access trojan, with an exploit by means of an automated tool called a weaponizer.  For example, an attacker may create an infected Microsoft Office document that is intended to be delivered via [phishing emails](https://www.upguard.com/blog/phishing).  Even though detection of weaponization is near impossible, it's an essential phase to understand and you can learn a lot by analyzing malware artifacts. Detection against weaponizer artifacts is one of the most durable and resilient defenses.   Security controls that can reduce the likelihood and impact of the weaponization stage: * Conducting security awareness training  * Performing malware analysis on not only the payload but how it was made * Building detections for weaponizers * Analyzing the timeline of when malware was created relative to when it was used. Old malware generally means it came off the shelf while new malware may mean active, tailored operations * Collecting files and metadata for future [digital forensics](https://www.upguard.com/blog/digital-forensics)  * Determining which weaponizer artifacts are common to which APT campaigns  ### 3. Delivery Delivery is the third phase of the cyber kill chain and refers to the [attack vectors](https://www.upguard.com/blog/attack-vector) used to deliver malicious payloads. According to [Lockheed Martin Computer Incident Response Team (LM-CIRT)](https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf) for the years 2004-2010 email attachments, websites, and USB media were the three most prevalent delivery vectors for weaponized payloads by APT actors.  While there is an entire industry dedicated to stopping attacks at this stage, people also play a critical role. If you look at the three most common attack vectors above, two of them rely on some form of human interaction.  By teaching people to stop when they feel like something isn't right, you can prevent the delivery of a load of different malicious software. While it won't stop [wormable exploits](https://www.upguard.com/blog/computer-worm) like EternalBlue that targeted outdated [SMB protocols](https://www.upguard.com/blog/smb-port) and led to the [WannaCry](https://www.upguard.com/blog/wannacry) [ransomware attack](https://www.upguard.com/blog/ransomware), it will prevent many less sophisticated attempts.   Countermeasures for the delivery stage include: * Analysis of delivery medium to understand the impact of target systems * Understanding targeted servers and people, their roles and responsibilities, and what sensitive data they have access to * Inferring the intent of adversaries based on targeting * Leveraging weaponizer artifacts to detect new malicious payloads at the point of delivery * Analyzing the time of day when the attack began * Collecting email and web logs for forensic reconstruction even if an intrusion is detected late, you must be able to determine when and how delivery began * [Vulnerability management](https://www.upguard.com/blog/vulnerability-management) and [vulnerability assessment](https://www.upguard.com/blog/vulnerability-assessment) processes  ### 4. Exploitation After the payload has been delivered to the victim, the exploitation triggers the intruders' code. Most often this will target an application or operating system vulnerability, but it could also simply exploit the victim or leverage an operating system feature that auto-executes code.  To add reliance consider investing in traditional hardening measures: * User awareness training and email testing for employees * Secure coding training for web developers * Regular vulnerability scanning and [penetration testing](https://www.upguard.com/blog/penetration-testing) * Endpoint hardening measures like restricting admin privileges and custom endpoint rules to block shellcode execution * [Endpoint](https://www.upguard.com/blog/endpoint-detection-and-response) process auditing to forensically determine origin of exploit ### 5. Installation The installation phase implies the attacker has an active exploit running on the target system. In this situation, they may look for additional [vulnerabilities](https://www.upguard.com/blog/vulnerability) or use [privilege escalation](https://www.upguard.com/blog/privilege-escalation) to gain additional access to the system to install a backdoor or remote access trojan that allows for persistence within the environment.  They may also employ some form of obfuscation to conceal their presence and mask activity to avoid detection and thwart an investigation. This can include wiping files and metadata, overwriting data with false timestamps and misleading information, or modifying critical information so it looks as though access was never granted.  Defending this stage means you should have some form of endpoint instrumentation to detect and log installation activity, such as: * Understanding if malware required administrator privileges or not * Alerting or blocking common installation paths * Endpoint processing auditing to discover abnormal file creations * Extract certificates from any signed executables * Understand compile time of malware to determine if it is old or new ### 6. Command and Control (C2) Typically compromised hosts communicate to an outside server to establish a [command & control](https://www.upguard.com/blog/what-is-a-botnet) channel. Once the connection is established, the intruders have hands on the [keyboard access to the target environment](https://www.upguard.com/blog/what-is-a-keylogger).   This stage is likely your last best chance to block the operation if adversaries can't issue commands you can prevent impact.  * Discover C2 infrastructure through malware analysis * Harden your network by consolidation the number of internet points of presence and require proxies for all types of traffic (HTTP, DNS) * Customize blocks of C2 protocols on web proxies * [Proxy](https://www.upguard.com/blog/proxy-server) category blocks including "none" or "uncategorized" domains * Prevent DNS sink holding and name server poisoning * Conduct open-source research to discover new adversary C2 infrastructure  ### 7. Actions on Objectives Now after progressing through the six previous phases of the intrusion kill chain, intruders can take actions to achieve their original objectives. This is typically a violation of either confidentiality, integrity, or availability or a combination of the three.  Alternatively, the attackers may only desire access to the initial victim in order to compromise additional systems and use lateral movement to gain access to new systems deeper in the network.  * Establish incident response playbook, including executive engagement and communications plan * Detect data exfiltration, lateral movement, unauthorized credential usage * Immediate analyst response to all alerts * Forensic agents pre-deployed to endpoints for rapid triage * Network package capture to recreate activity * Conduct damage assessment with subject matter experts ## How UpGuard Can Improve your Organization's Security Posture For the assessment of your information security controls,[ ](https://www.upguard.com/product/vendorrisk)[UpGuard Breach Risk](https://www.upguard.com/product/breach-risk) can monitor your organization for 70+ security controls providing a simple, easy-to-understand [cyber security rating](https://www.upguard.com/blog/what-are-security-ratings) and automatically detect leaked credentials and data exposures in S3 buckets, Rsync servers, GitHub repos, and more. This includes open ports and other services that are exposed to the public Internet. Our platform explicitly checks for nearly 200 services running across thousands of ports, and reports on any services we can't identify, as well as any open ports with no services detected.  UpGuard Vendor Risk can minimize the amount of time your organization spends assessing third-party information security controls with its industry-leading [vendor questionnaire software](https://www.upguard.com/product/vendor-risk/questionnaire-management). eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)