What is Kill Chain?

The model was adapted from military targeting doctrine to describe how APT actors conduct campaigns. Each stage must complete for the attack to succeed, which means defenders have multiple opportunities to detect and disrupt.

Reconnaissance: the attacker gathers target information (OSINT, scanning). Weaponization: a delivery mechanism is created (exploit, macro document). Delivery: the weapon reaches the target (phishing email, compromised website). Exploitation: the vulnerability is triggered. Installation: malware establishes persistence. Command and Control (C2): the attacker establishes a communication channel. Actions on Objectives: the attacker achieves their goal (data theft, ransomware, sabotage).

The earlier in the chain a defender detects and disrupts, the lower the impact. Blocking at Delivery (catching the phishing email) is far better than detecting at Actions on Objectives (noticing ransomware during encryption). Defense-in-depth and proactive controls at each stage are superior to purely reactive detection.