4.3. Cyber Kill Chain (Lockheed Martin)

1. Reconnaissance
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. Command & Control
7. Actions on Objectives

The Cyber Kill Chain is a framework developed by Lockheed Martin to describe the various stages of a cyberattack. It is structured into seven distinct stages that help security professionals understand how attacks are executed, allowing them to effectively defend against them. Each stage represents a critical point in the attack where different tactics and techniques are employed by the adversary.

Think of the Cyber Kill Chain like planning a heist in a movie. The thieves first scout the location (Reconnaissance), then they gather their tools (Weaponization), and then they plan how to get into the building (Delivery). After that, they break in (Exploitation) and disable the security system (Installation) before finally taking what they came for (Actions on Objectives). Just like in the heist, each step is crucial and if one part fails, the entire plan might fall apart.

The first stage involves gathering information about the target to identify vulnerabilities.

In the reconnaissance stage, attackers collect information about their target. This can involve searching for publicly available data, such as employee details, technical specifications, and general organizational structure. The aim is to understand the weaknesses and potential entry points into the target's systems. This process can be either passive, where no direct contact with the target occurs, or active, involving direct interaction.

Consider a burglar who wants to break into a house. Before making a move, they might observe the neighborhood, take note of the routines of the residents, look for open windows, or check if there are any security cameras. This initial observation is crucial to planning their next steps safely.

After gathering intelligence, attackers create a deliverable payload.

In this stage, attackers develop a weapon based on the information acquired during reconnaissance. This often means combining an exploit (to take advantage of a vulnerability) with a backdoor or malicious payload. The goal is to create a piece of malicious software that can be deployed against the target once access is attempted.

Imagine a chef preparing a special dish. They have gathered all the ingredients needed (information) and now they combine them creatively to form a unique recipe (the malware) that will have the desired effect once served (deployed against the target).

This stage encompasses the transmission of the weapon to the target system.

During the delivery phase, the attacker sends their malicious payload to the intended target. This can be done through various means such as email attachments, malicious websites, or USB drives. The method of delivery is crucial because it must successfully reach the target's system for the attack to proceed to the next stage.

Think of this stage like sending an invitation to a secret party. The invitation must reach your friend’s mailbox so they can see it and respond. If something goes wrong in the mailing process, your friend won’t get the invite, and the party (attack) can’t happen.

In this phase, the attacker takes advantage of vulnerabilities in the target system.

The exploitation phase is where the attacker activates the weapon against the target. This involves executing the code that was delivered to the system to exploit the identified vulnerabilities. This step may lead to unauthorized access, allowing attackers to control the system or data.

This is akin to a thief using a lock pick to unlock a door. Once the lock is opened, they gain entry into the house (the system), allowing them to move freely within the space for their aims.

Here, the attackers establish a foothold in the target system.

After successfully exploiting a vulnerability, attackers often install malware that ensures their continued access to the compromised system. This malware can be a remote access tool (RAT) or other types of trojans that allow for persistent connectivity back to the attacker.

It's like a burglar setting up a secret door in a house after breaking in. They want a way to come and go without being detected again, ensuring easy access for future visits.

Attackers create a channel for remote command and control of the system.

In this phase, attackers establish a command and control (C2) channel to communicate with the compromised systems. This allows them to send commands, exfiltrate data, or deploy additional malicious payloads. Maintaining this channel is critical as it gives attackers the ability to manage the exploited systems remotely.

Imagine a coach using a headset to communicate with players on a field. The coach (attacker) needs to direct the players (compromised systems) on what to do in the game, ensuring they execute the strategy effectively.

Finally, the attacker achieves their intended goal.

In the last stage, attackers pursue their final objectives, which could range from stealing sensitive data to damaging systems or launching further attacks on other networks. This is the culmination of their efforts throughout the kill chain.

Continuing the heist analogy, this is when the burglars finally take the valuables they planned to steal. All their previous planning and execution lead to this moment where they realize their goal.

--