What is an Intrusion Kill Chain?
An Intrusion Kill Chain is the stages or phases that can be used in attacks by attackers. The phases provided in Lockheed Martin’s paper include:
- Reconnaissance
- Weaponization
- Delivery
- Exploitation
- Installation
- Command and Control (C2)
- Actions on Objectives
Although you can probably tell from the name of each of these phases what they encompass, let me quickly summarize them for you. Note that this is based on my own interpretation of Lockheed Martin’s paper, and other interpretations are possible.
Attackers select their target in the Reconnaissance phase (Hutchins, Cloppert, Amin, n.d.). Certainly, many attackers select targets opportunistically, many times by coincidence, as evidenced by all the commodity malware present on the internet.
So-called Advanced Persistent Threat (APT) attackers spend time and effort researching who they should target based on their motivations...
