What is Kill Chain?

Each stage has a distinct defensive answer. Reconnaissance is the attacker gathering target information through OSINT, DNS enumeration, port scanning, or LinkedIn research on employees, defended against mainly through reduced public exposure and monitoring for scanning activity against your perimeter. Weaponization is where a delivery mechanism gets built, a malicious macro embedded in a document, an exploit paired with a payload, and happens entirely outside the target's visibility, which is why this stage is rarely something a SOC can detect directly. Delivery is the weapon reaching the target, most commonly a phishing email, a compromised website serving a drive-by download, or a USB drop, and it's the first stage where the defender's own telemetry (email gateway logs, web proxy logs) has real visibility. Exploitation is the vulnerability actually being triggered, a macro executing, a browser exploit firing, and Installation is the point where malware establishes persistence on the host, a scheduled task, a registry run key, a new service.

Command and Control (C2) is the attacker establishing an outbound communication channel back to infrastructure they control, usually a beacon over HTTPS or DNS designed to blend into normal traffic, and this is frequently the first stage a SOC actually detects, since NDR and SIEM correlation are tuned to catch beaconing patterns. Actions on Objectives is the attacker finally doing the thing they came to do: data theft, ransomware deployment, sabotage, or establishing a foothold for a future operation.

The model's core defensive insight is that detection cost scales with how late in the chain you catch it. Blocking at Delivery, the phishing email never reaches the inbox, costs you almost nothing: no incident, no cleanup, no data at risk. Detecting at Actions on Objectives, noticing files being encrypted or a large outbound transfer in progress, means the attacker has already completed six prior stages undetected and you're now doing damage control rather than prevention. This is the direct rationale behind investing in layered controls at every stage rather than concentrating detection budget entirely on the perimeter or entirely on the endpoint.

The Kill Chain is often used alongside, not instead of, MITRE ATT&CK: the Kill Chain gives you the coarse-grained sequence of an attack's life cycle, while ATT&CK gives you the fine-grained catalog of specific techniques an actor might use to accomplish each Kill Chain stage. A single Kill Chain stage like Installation might map to a dozen different ATT&CK persistence techniques depending on the OS and the actor's tradecraft.