> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/crto/getting-started/attack-lifecycle/cyber-kill-chain.md).

# Cyber Kill Chain

> The first publication of attack lifecycle was introduced by Lockheed martin - dubbed the 'Cyber Kill Chain'

* It described each phase an attacker must go through to compromise a target.

 

—-> **Reconnaissance** - *scout a target and find potential attack vectors.*

\---> **Weaponization** - *developl a malicious payload*

\---> **Delivery** - *develop a means of delivering the payload*

\---> **Exploitation** - *the initial attack of delivering the weaponized payload*

*--->* **Installation** - *Installing persistent malware on the target.*

*--->* **Command & Control** *- establish a means of controlling compromised targets.*

*--->* **Actions on Objectives** *- achieve the operational goal (defacement, data theft, etc.)*

**Cyber Kill Chain**<br>

* **What it does well:**  *It tells you where an attacker is in the attack lifecycle (e.g. they have gained initial access).*

* **What it lacks (**&#x74;he drawbac&#x6B;**):** *it doesn't explain the "how". Once an adversary is inside a network, the Kill Chain framework alone doesn't detail the exact tools, techniques, or procedures (TTPs) they use to move laterally, steal data, or cause damage.*

&#x20;

* **How defenders fix this:** *Because the Kill Chain lacks this granular detail, modern cybersecurity teams combine it with the MITRE ATT\&CK Framework,*
  * *While the Kill Chain gives the high-level sequence of events, MITRE ATT\&CK provides the deep-dive intelligence on exactly how adversaries carry out those specific actions.*