Digital Forensics and Incident Response - Second Edition

Cyber kill chain

The cyber kill chain is a concept that was first authored by three researchers at Lockheed Martin (https://www.lockheedmartin.com/content/dam/lockheed/data/corporate/documents/LM-White-Paper-Intel-Driven-Defense.pdf). The cyber kill chain outlines the stages of a network penetration that an attacker would have to go through to reach their ultimate goal. From here, organizations can extrapolate the various methods and IOCs that the organization may observe using detection capabilities enhanced with threat intelligence.

The cyber kill chain breaks down a network attack into seven steps that the attacker will progress through:

• Reconnaissance: Attackers often spend a considerable amount of time reviewing open source intelligence ...