The Cyber Kill Chain Explained: How Attacks Actually Unfold

An attacker doesn't just "hack in" and steal your data in one click. Real intrusions happen in stages—and every stage is a chance to catch them.

That's the whole idea behind the Cyber Kill Chain. It's one of the first frameworks every SOC analyst learns, and once it clicks, alerts stop looking random and start looking like a story.

Let's break it down.

So What Is the Cyber Kill Chain?

The Cyber Kill Chain is a model that maps out the stages of a cyberattack, from the attacker's first bit of research to the moment they actually pull off their goal.

Lockheed Martin created it back in 2011, borrowing the "kill chain" idea from the military. The point wasn't to make attacks sound scary—it was to give defenders a way to think about where in an attack they could step in and break the chain.

And that's the key insight: an attacker has to complete every stage to win. You only have to stop them at one.

The 7 Stages, In Plain English

Here's how an attack unfolds, stage by stage.

1. Reconnaissance

The attacker does their homework. They scrape LinkedIn for employee names, look up your public IP ranges, hunt for exposed servers, and figure out what tech you run.

No alarms usually fire here—it mostly happens off your network. But leaked emails and job postings tell attackers more than you'd think.

2. Weaponization

Now they build the weapon. Think a malicious Word doc, a booby-trapped PDF, or malware bundled with an exploit.

This also happens on the attacker's side, so you won't see it directly. But knowing it happened helps you understand what shows up next.

3. Delivery

The weapon gets sent your way. Phishing email, malicious link, USB drop, compromised website—this is the handoff.

This is often your first real chance to catch something. Email gateways, web proxies, and user reports all live here.

4. Exploitation

The victim clicks. The malicious code runs and takes advantage of a vulnerability—maybe an unpatched app, maybe just a user enabling macros.

This is where "suspicious" becomes "compromised." Endpoint logs start telling the story.

5. Installation

The attacker sets up shop. They install malware or a backdoor so they can get back in even if that first foothold gets cleaned up.

New services, weird scheduled tasks, unexpected registry changes—this is where persistence shows up in your logs.

6. Command & Control (C2)

The malware phones home. It connects to the attacker's server and waits for orders—basically a remote control channel into your network.

Beaconing traffic, connections to sketchy domains, weird outbound patterns at 3 a.m.—all C2 tells.

7. Actions on Objectives

Finally, the attacker does what they came to do. Steal data, encrypt everything for ransom, move deeper into the network, whatever the goal was.

By now the damage is real. But even here, catching it fast can be the difference between an incident and a catastrophe.

Why Should a SOC Analyst Actually Care?

Because it turns you from an alert-closer into an investigator.

When an alert fires, the kill chain gives you a mental map. You can ask: where in the attack are we? An alert about a suspicious email attachment is Delivery. A weird outbound connection is probably C2. That context changes how urgently you respond.

It also helps you connect dots. Three separate low-priority alerts might each look like noise. Line them up on the kill chain—Delivery, then Exploitation, then C2—and suddenly you're looking at one real intrusion in progress.

That's exactly the skill you use when you build an attack timeline during an investigation.

The Kill Chain vs. MITRE ATT&CK: What's the Difference?

Great question, because people mix these up constantly.

The Cyber Kill Chain is the big-picture story—seven broad phases, start to finish. It's simple and easy to explain to non-technical folks.

MITRE ATT&CK is the detailed playbook—hundreds of specific techniques attackers actually use, organized into tactics. It's what you reach for when you need to know exactly how an attacker moved.

Think of it this way: the kill chain is the movie trailer, ATT&CK is the full script. Most modern SOCs use ATT&CK day-to-day, but the kill chain is still the cleanest way to understand the shape of an attack.

Honestly, learn both. They complement each other.

Where the Kill Chain Falls Short (Real Talk)

Here's where we gotta be honest—the model isn't perfect, and plenty of analysts have gripes.

- It's very perimeter-focused. The original model assumes attacks come from outside and move inward. Insider threats and identity-based attacks don't fit as neatly.

- It's linear. Real attacks loop, skip stages, and run steps in parallel. Attackers don't march politely from step 1 to step 7.

- It undersells the "left of boom" stuff. Recon and weaponization matter, but you can barely see them, so the model can feel top-heavy.

None of this makes it useless. It just means the kill chain is a starting framework, not the final word. Pair it with ATT&CK and you're in good shape.

How Do You Actually Use This on the Job?

Start mapping alerts to stages in your head.

Every time an alert fires, ask "which stage is this?" Do it enough and it becomes automatic. You'll start spotting when a single incident spans multiple stages—which is your cue that something real is happening.

Then practice breaking the chain. For each stage, ask "what control would stop an attacker here?" Email filtering breaks Delivery. Patching breaks Exploitation. Network monitoring breaks C2. This is the mindset that separates good analysts from great ones—and it's the foundation of detection engineering.

And learn the difference between chasing indicators and chasing behavior. A single bad IP is easy to block but easy to change. Understanding how an attacker operates across the kill chain is far more durable—more on that in IOCs vs. TTPs.

TL;DR – The Kill Chain Is Your Map of an Attack

The Cyber Kill Chain breaks an attack into seven stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives. The attacker has to nail every stage—you only have to break one. Learn it as your big-picture map, then layer MITRE ATT&CK on top for the technical detail.

---

FAQs

Is the Cyber Kill Chain still relevant in 2026?

Yep—as a teaching and thinking tool, absolutely. Most SOCs use MITRE ATT&CK for day-to-day detection work, but the kill chain is still the clearest way to understand the overall flow of an attack. Learn it first, then go deeper with ATT&CK.

What's the difference between the Cyber Kill Chain and MITRE ATT&CK?

The kill chain gives you seven broad phases—the big-picture story. ATT&CK gives you hundreds of specific techniques mapped to tactics—the detailed how. The kill chain is simpler; ATT&CK is more actionable. Good analysts use both.

Do I need to memorize all seven stages for a SOC interview?

It helps a lot. Interviewers love asking you to walk through the kill chain and map a scenario to it. Know the seven stages in order and be ready to give an example of what an analyst might see at each one.

---

Sources & References:

- Lockheed Martin: The Cyber Kill Chain

- MITRE ATT&CK Framework

- NIST Cybersecurity Framework

---

Final thought: Frameworks like the kill chain aren't about memorizing lists. They're about training your brain to see an attack as a sequence you can interrupt. Once you see it that way, you stop reacting to alerts and start hunting attackers.

How EpicDetect Can Help

Want to practice this for real—not multiple choice, an actual investigation? Adventures Season Zero drops you into a story-driven SOC case where you'll trace an attack across the kill chain yourself. It's completely free.

Want structured lessons alongside it? Head to the EpicDetect Atlas for SIEM fundamentals, log analysis, and MITRE ATT&CK-tagged challenges.

New here? Sign up and start for free. No credit card required.