The Cyber Kill Chain

The Cyber Kill Chain

1. Recon - Reconnaissance
   • The attacker tries to learn as much as possible about the target, such as the types of servers, operating system, IP addresses, names of users, and email addresses, which can help the success of the attack.
   • OSINT falls under this step ¹
   • Tools for this step:
     • theHarvester - Command-line tool to get data from multiple public data sources
     • Hunter.io - Email hunting tool
     • OSINT Framework - Collection of OSINT tools
2. Weaponization
   • Preparing a file with a malicious component
3. Delivery
   • Delivering the “weaponized” file to the target
   • Examples: Phishing or infected USB devices ²
4. Exploitation
   • Execute the malicious component
5. Installation:
   • Install the malware on the target system, including backdoor to gain persistence ³
6. Command & Control (C2)
   • The attacker has the ability to command and control the target system.
   • Most common communication channels: HTTP/s and DNS Tunneling
7. Actions on Objectives
   • Achieve their objectives, such as data exfiltration

The Cyber Kill Chain was created and last updated in 2011. For a better view, it can be combined with more modern approaches like MITRE ATT&CK and Unified Kill Chain.

References

• TryHackMe: Network Security
• Lockheed Martin: Cyber Kill Chain
• Intro to Macros and VBA for Script Kiddies

1. https://www.varonis.com/blog/what-is-osint ↩

2. https://www.csoonline.com/article/3534693/cybercriminal-group-mails-malicious-usb-dongles-to-targeted-companies.html ↩

3. https://www.offensive-security.com/metasploit-unleashed/meterpreter-backdoor/ ↩