The cyber kill chain

The timeline that was created as part of the incident investigation provides a view into the sequence of events that the adversary took. This view is useful but does not have the benefit of context for the events. Going back to the RDP example, the analyst can point to the date and time of the connection but lacks insight into at which stage of the attack the event took place. One construct that provides context is placing the events into a kill chain that describes the sequence of events the adversary took to achieve their goal.

The military has used the concept of kill chains to a great extent to describe the process that units must execute to achieve an objective. One version of this concept was outlined in the United States military’s targeting doctrine of Find, Fix, Track, Target, Engage, Assess (F2T2EA). This process is described as a chain because it allows a defender to disrupt the process at any one step. For example, an adversary that you can...