Author
Eric M. Hutchins, Michael J. Cloppert, Rohan M. Amin (Lockheed Martin)
1 reading card from 1 book · 2011.
1 card
Seven phases, one chain: break it as high as you can, with the indicators the campaign reuses.
The 2011 paper borrowed from military targeting doctrine the idea of a chain — find, fix, track, target, engage, assess — and rewrote it for intrusions: reconnaissance (researching targets: websites, mailing lists, technologies), weaponization (building the payload into a document or file), delivery (email, website, USB), exploitation (the code runs), installation (persistence), command and control (the channel to the outside) and actions on objectives (exfiltration, lateral movement). The essence, the authors say, is that the intruder "must develop a payload to breach a trusted boundary, establish a presence and only from there take actions" — and a single failure along the way interrupts the entire process. The paradigm shift is for defence. Until then defence was reactive: detect the code, delete it. The chain says every phase leaves indicators (a sender, a hash, a domain, a persistence technique) and that a campaign's indicators repeat from one intrusion to the next, because the adversary reuses infrastructure and tools. Whoever maps campaigns — not incidents — can "move detection up the chain" and block delivery or exploitation before installation. The limits, voiced by critics too: the model is linear and malware-centred; an attack with stolen credentials or an insider abuse has no "weaponization"; the post-compromise phases are compressed into one, which is why MITRE ATT&CK (lesson 31) detailed exactly that part. It nevertheless remains the frame in which the right question is asked: not "what was this file", but "in which phase of whose campaign are we".
“The intrusion kill chain is defined as reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives.”