What is the Cyber Kill Chain?

The Cyber Kill Chain was introduced by Eric M. Hutchins, Michael J. Cloppert, and Rohan M. Amin of Lockheed Martin in the 2011 paper "Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains", presented at the 6th International Conference on Information Warfare and Security. The authors adapted the U.S. military's "kill chain" doctrine — find, fix, track, target, engage, assess (F2T2EA) — into a defender's framework for advanced persistent threats (APTs).

The seven stages are sequential and dependent. Reconnaissance is target research — OSINT, harvesting employee emails, scanning for exposed services. Weaponization pairs a remote-access trojan with an exploit, typically into a deliverable payload such as a malicious PDF or Office macro. Delivery is transmission — spearphishing email, USB drop, watering-hole compromise. Exploitation triggers code execution, often against a known CVE in a browser, document reader, or server. Installation establishes persistence via a backdoor, scheduled task, or registry run key. Command and Control opens an outbound channel — historically HTTPS beacons or DNS tunneling — giving the operator hands-on-keyboard access. Actions on Objectives is the final stage: data exfiltration, lateral movement, destruction, or ransomware detonation.

The model's key innovation was treating intrusion as a process with breakable dependencies, not a single event. Lockheed argued that any disruption — block, deny, degrade, deceive, contain — earlier in the chain costs the defender less and the adversary more. The defense matrix mapped the seven stages against six courses of action (detect, deny, disrupt, degrade, deceive, destroy), producing a 42-cell planning grid that became standard in SOC playbooks at large enterprises and government agencies.

The framework has well-documented limitations. It is malware-and-perimeter centric, assumes a linear path, underweights insider threats, and stops at the perimeter breach — saying little about lateral movement, privilege escalation, or living-off-the-land techniques. Those gaps were filled by MITRE ATT&CK, first released publicly in 2015 and now maintained as a knowledge base of 14 tactics and over 600 techniques mapped to real-world adversary tradecraft. ATT&CK does not replace the Kill Chain; the two are commonly used together, with the Kill Chain framing the campaign arc and ATT&CK detailing the techniques within each stage.

A 2017 variant, the Unified Kill Chain by Paul Pols (Fox-IT / Leiden University master's thesis), explicitly merged Lockheed's chain with ATT&CK into 18 phases including pivoting, privilege escalation, and exfiltration — addressing the linearity critique. Other extensions include the Industrial Control System (ICS) Cyber Kill Chain by Michael J. Assante and Robert M. Lee (SANS, 2015), which adds a second stage covering ICS attack development, validation, and execution against operational technology — the model later used to dissect the December 2015 Ukraine power grid attack and the 2017 TRITON/TRISIS attack on a Saudi petrochemical safety system.

In modern practice, the Kill Chain remains the lingua franca for executive briefings and threat intelligence reporting because it tells a coherent story in seven boxes. Tier-1 analysts work the chain; Tier-2/3 analysts pivot to ATT&CK. Detection engineers map alerts to both. The 2024 Verizon DBIR continues to classify breach patterns against kill-chain-style stages, and CISA threat advisories still reference the Lockheed model when narrating campaign timelines.