Cyber Killchain

The Cyber Kill Chain is a concept developed by Lockheed Martin to describe the stages of a cyber attack. It outlines the steps attackers follow to achieve their objectives, whether that's stealing data, disrupting systems, or other malicious activities. Understanding the kill chain helps organizations identify and mitigate threats at various stages of the attack.

Cyber Kill Chain Methodology

The cyber kill chain methodology is a component of intelligence-driven defense for the identification and prevention of malicious intrusion activities. This methodology helps security professionals in identifying the steps that adversaries follow in order to accomplish their goals. The cyber kill chain is a framework developed for securing cyberspace based on the concept of military kill chains. This method aims to actively enhance intrusion detection and response. The cyber kill chain is equipped with a seven-phase protection mechanism to mitigate and reduce cyber threats. According to Lockheed Martin, cyberattacks might occur in seven different phases, from reconnaissance to the final accomplishment of the objective. An understanding of cyber kill chain methodology helps security professionals to leverage security controls at different stages of an attack and helps them to prevent the attack before it succeeds. It also provides greater insight into the attack phases, which helps in understanding the adversary's TTPs beforehand.

Cyber Killchain-1760726758174.webp

Stages of the Cyber Kill Chain

Discussed below are various phases included in cyber kill chain methodology:

1. Reconnaissance (Stage 1)

An adversary performs reconnaissance to collect as much information about the target as possible to probe for weak points before actually attacking. They look for information such as publicly available information on the Internet, network information, system information, and the organizational information of the target. By conducting reconnaissance across different network levels, the adversary can gain information such as network blocks, specific IP addresses, and employee details. The adversary may use automated tools to obtain information such as open ports and services, vulnerabilities in applications, and login credentials. Such information can help the adversary in gaining backdoor access to the target network.

Description: Attackers gather information about their target. This can include identifying vulnerabilities, system configurations, employee details, network infrastructure, and more.

Methods: Social engineering, network scanning, open-source intelligence (OSINT), website and domain reconnaissance.

Activities of the adversary include the following:

Gathering information about the target organization by searching the Internet or through social engineering
Performing analysis of various online activities and publicly available information
Gathering information from social networking sites and web services
Obtaining information about websites visited
Monitoring and analyzing the target organization's website
Performing Whois, DNS, and network footprinting
Performing scanning to identify open ports and services

Weaponization (Stage 2)

The adversary analyzes the data collected in the previous stage to identify the vulnerabilities and techniques that can exploit and gain unauthorized access to the target organization. Based on the vulnerabilities identified during analysis, the adversary selects or creates a tailored deliverable malicious payload (remote-access malware weapon) using an exploit and a backdoor to send it to the victim. An adversary may target specific network devices, operating systems, endpoint devices, or even individuals within the organization to carry out their attack. For example, the adversary may send a phishing email to an employee of the target organization, which may include a malicious attachment such as a virus or worm that, when downloaded, installs a backdoor on the system that allows remote access to the adversary.

Description: In this phase, attackers create malicious payloads, such as viruses, malware, or exploit kits, that can be used to infiltrate a system. The weapon is then paired with a delivery method (e.g., a phishing email or malicious attachment).

Methods: Developing malicious code or a backdoor, crafting exploits, preparing phishing emails.

The following are the activities of the adversary:

Identifying appropriate malware payload based on the analysis
Creating a new malware payload or selecting, reusing, modifying the available malware payloads based on the identified vulnerability
Creating a phishing email campaign
Leveraging exploit kits and botnets

Delivery (Stage 3)

The previous stage included creating a weapon. Its payload is transmitted to the intended victim(s) as an email attachment, via a malicious link on websites, or through a vulnerable web application or USB drive. Delivery is a key stage that measures the effectiveness of the defense strategies implemented by the target organization based on whether the intrusion attempt of the adversary is blocked or not.

Description: The attacker delivers the weaponized payload to the target. This could be done through various vectors such as email (phishing), USB devices, malicious websites, or exploiting network vulnerabilities.

Methods: Phishing emails, malicious attachments, drive-by downloads, USB drops, or exploiting vulnerabilities.

The following are the activities of the adversary:

Sending phishing emails to employees of the target organization
Distributing USB drives containing malicious payload to employees of the target organization
Performing attacks such as watering hole on the compromised website
Implementing various hacking tools against the operating systems, applications, and servers of the target organization

Exploitation (Stage 4)

After the weapon is transmitted to the intended victim, exploitation triggers the adversary's malicious code to exploit a vulnerability in the operating system, application, or server on a target system. At this stage, the organization may face threats such as authentication and authorization attacks, arbitrary code execution, physical security threats, and security misconfiguration.

Description: Once the weapon reaches the target, it exploits a vulnerability in the system to gain initial access. This often involves exploiting software flaws, security misconfigurations, or human errors. (Attackers code has been triggered)

Methods: Exploiting a vulnerability (e.g., buffer overflow, SQL injection), running a malicious script or software, or using stolen credentials.

Activities of the adversary include the following:

Exploiting software or hardware vulnerabilities to gain remote access to the target system

Installation (Stage 5)

The adversary downloads and installs more malicious software on the target system to maintain access to the target network for an extended period. They may use the

Description: The attacker installs malware or malicious tools on the system to maintain persistence. This ensures they have continuous access, even if the original exploit is detected and remediated.

Methods: Installing Trojans, backdoors, remote access tools (RATs), or creating new user accounts with elevated privileges.

Command & Control (C2) (Stage 6)

Description: The attacker establishes communication between the compromised system and their own servers (command and control). This allows the attacker to issue further instructions, exfiltrate data, or move laterally within the network.

Methods: Using remote shell commands, C2 servers, encrypted channels, or social engineering to maintain communication.

Actions on Objectives (Stage 7)

Description: The attacker accomplishes their ultimate goal, such as stealing data, deploying ransomware, or disrupting the targeted system. This is where the real damage is done.

Methods: Data exfiltration, encryption (ransomware), system disruption (Denial of Service), or tampering with data or system configurations.

Application of the Cyber Kill Chain

The Cyber Kill Chain framework is valuable for defense as it helps organizations detect and respond to attacks at each stage. Here's how:

Detection and Prevention: By understanding the stages, security teams can deploy controls and defenses that prevent, detect, or disrupt attacks at each stage.
Incident Response: Identifying where the attack is in the kill chain allows for more targeted responses.
Threat Intelligence: Information gathered at each stage of the kill chain can be shared within the cybersecurity community to help others defend against similar attacks.

Key Strategies for Mitigation

Reconnaissance: Implement threat hunting and monitoring of external sources for any signs of attack preparation.
Weaponization and Delivery: Employ email filtering, network segmentation, and web security to prevent malicious payloads.
Exploitation: Patch vulnerabilities, conduct regular security assessments, and train employees on recognizing phishing attempts.
Installation: Utilize endpoint protection and implement strict access controls.
Command and Control: Monitor network traffic for unusual patterns or C2 communications.
Actions on Objectives: Encrypt sensitive data, deploy backup systems, and implement strong authentication methods.