The Cyber Kill Chain: How CTI Analysts Map Attacks and Break the Adversary’s Sequence

Introduction

The Cyber Kill Chain is the most widely used attack lifecycle framework in threat intelligence. Developed by Lockheed Martin, it models an intrusion as seven sequential stages – from reconnaissance through actions on objectives. The core insight is simple but powerful: break the chain at any stage, and the attack fails. The earlier you break it, the less damage the adversary can do.

I have used the Kill Chain in incident response engagements, threat hunting operations, and CTI programme development. It is not perfect – modern attacks blur the stage boundaries – but as a thinking tool, it remains indispensable. This guide covers each stage, the intelligence questions to ask at each one, and how to combine Kill Chain analysis with the Diamond Model for a complete intrusion picture.

The Seven Stages: What Happens at Each One and What Intelligence to Look For

Each Kill Chain stage represents a different phase of the adversary’s operation. At each stage, the adversary leaves different indicators, and you have different opportunities to detect them. Understanding what to look for at each stage turns the Kill Chain from a theoretical model into an operational tool.

Stage 1: Reconnaissance. The adversary researches the target. They harvest email addresses from LinkedIn, scan for open ports, identify technology stacks from job postings, and probe external infrastructure. Intelligence to collect: what scanning activity have you observed against your external perimeter? What OSINT can you gather about your own organisation that an adversary would find? The best defence against recon is knowing what an attacker sees when they look at you.

Stage 2: Weaponization. The adversary builds or acquires the attack tooling – a malicious document, a compromised website, a weaponized USB. Intelligence to collect: what malware families are currently targeting your sector? What exploit kits are active? This stage is largely invisible to defenders, but threat intelligence on active tooling helps you anticipate what might be coming.

Stage 3: Delivery. The adversary sends the weaponized payload to the target – a phishing email, a drive-by download, a physical USB drop. This is your best detection opportunity. Intelligence to collect: what phishing campaigns are targeting your sector right now? What domains are being used for delivery? If you can block delivery, the attack ends here. Feed data from the threat feed pipeline directly into email and web gateways for this stage.

Stage 4: Exploitation. The payload executes, exploiting a vulnerability to gain initial access. Intelligence to collect: what vulnerabilities are being actively exploited in the wild? Are any of them present in your environment? This is where vulnerability management intersects with CTI. If a CVE is being exploited by a threat actor targeting your sector, it is no longer a patch management issue – it is an incident waiting to happen.

Stage 5: Installation. The adversary establishes persistence – installing malware, creating backdoor accounts, setting up scheduled tasks. Intelligence to collect: what persistence mechanisms does this actor use? What registry keys, services, or scheduled tasks should your hunters be looking for? This is the stage where threat hunting delivers the most value. If you can find the persistence mechanism, you can evict the adversary before they achieve their objective.

Stage 6: Command and Control. The adversary establishes a communication channel to control the compromised system. Intelligence to collect: what C2 infrastructure does this actor use? What protocols? What beaconing patterns? Network detection at this stage is highly effective – C2 traffic has distinctive patterns that differ from normal business communication. Blocking C2 channels severs the adversary’s control even if they are already inside.

Stage 7: Actions on Objectives. The adversary achieves their goal – exfiltrating data, encrypting files for ransom, destroying systems. Intelligence to collect: what is this actor’s objective? What data do they typically target? How long do they dwell before acting? If you detect the attack at this stage, you are in incident response mode. The goal is containment and eradication. Intelligence on the actor’s typical exfiltration methods and post-exploit behaviour guides your response.

Combining Kill Chain with the Diamond Model: A Complete Intrusion Picture

The Kill Chain tells you what stage the adversary is at. The Diamond Model tells you who they are, what they are using, how they are communicating, and who they are targeting. Together, they form a complete intrusion analysis framework. I use them side by side on every investigation.

For each stage of the Kill Chain, draw a separate diamond. The reconnaissance diamond shows the adversary’s scanning infrastructure and the information they gathered. The delivery diamond shows the phishing domain, the malware attachment, and the targeted users. The C2 diamond shows the command infrastructure, the beaconing protocol, and the compromised hosts. Connecting the diamonds across stages reveals the full operation.

This combined approach answers the three most important questions in any intrusion analysis. First, where are we in the attack lifecycle? That is the Kill Chain stage. Second, what do we know about this specific event? That is the Diamond Model. Third, what is the relationship between this event and previous events? That is the cross-diamond analysis from the pivot analysis methodology. Answer all three and you have a complete intelligence product ready for the SOC, the CISO, or the threat actor profile you are building.

The Kill Chain is sometimes criticised as being too linear for modern attacks, where stages overlap and adversaries move laterally in loops rather than straight lines. It is a fair critique. But as an analytical framework – a way to ask “where are we, what do we know, what should we do next?” – it remains the most practical tool I have. Use it to structure your thinking, not to constrain it. The adversary does not follow your framework. Your framework helps you understand what the adversary is doing.

For the next step, the threat actor profiling guide shows how to turn Kill Chain and Diamond Model analysis into finished adversary profiles that your SOC can operationalize.