Lesson 3.1: The Cyber Kill Chain: an attack step by step

Attacks are not a single moment but a chain of steps. Using the Cyber Kill Chain model (reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives), you rebuild a real-looking incident from four log files: who scanned the site, which e-mail carried the attack, what ran, how it stayed, where it talked to and what it took. Then you see why breaking any one link stops the whole attack.

19 min

You will learn to

Name the seven phases of the Cyber Kill Chain
Map log entries to phases
Build an incident timeline from several logs
Explain why defenders try to break the chain as early as possible

Key terms

Cyber Kill Chain: A model that splits an attack into seven phases, from first research to the final goal.
1 Reconnaissance: Gathering information about the target: scanning sites and networks, reading public pages, finding staff names.
2 Weaponisation · 3 Delivery: Preparing the attack tool (a malicious file, a fake page), then getting it to the target (e-mail, a website, a USB stick).
4 Exploitation · 5 Installation: Making the code run (through a software flaw or by tricking a person), then setting it up to stay, for example as a scheduled task.
6 Command and control (C2): The infected system regularly contacts the attacker's server for instructions.
7 Actions on objectives: Doing what the attack was for: stealing data, encrypting files, sabotage.
Timeline: Events from different sources put in time order, so the story of an incident can be read from start to end.

← Looking at text files: cat, less and more · All lessons · The Linux filesystem hierarchy →