type: concept · created: 2026-08-18 · updated: 2026-08-18 · tags: [framework, technique, intel-cycle] · confidence: high · affected_sectors: [technology, government, finance, defence] · au_impact: true
Lockheed Martin Cyber Kill Chain
The Cyber Kill Chain is Lockheed Martin's model of the intrusion lifecycle, describing the sequence of steps an adversary must complete to compromise a network. It is the direct intellectual predecessor of Mitre Attack and remains a foundational model in threat intelligence and security operations.
Overview
- Origin: Lockheed Martin, first formalised in the 2011 paper Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains (Hutchins, Cloppert & Amin)
- Concept: Adapted from the military "kill chain" (find, fix, track, target, engage, assess)
- Purpose: Providing a structured, stage-by-stage view of an intrusion so defenders can detect and interrupt it at multiple points
The Seven Stages
| Stage | Description |
|---|---|
| 1. Reconnaissance | Researching, identifying, and selecting targets (e.g. harvesting email addresses) |
| 2. Weaponisation | Coupling a deliverable with a payload (e.g. a weaponised PDF or macro) |
| 3. Delivery | Transmitting the weapon to the target (email attachment, malicious link, USB) |
| 4. Exploitation | Triggering the weapon to execute code on the victim system |
| 5. Installation | Installing malware / establishing remote access on the target |
| 6. Command & Control (C2) | Establishing and controlling a channel back to the operator |
| 7. Actions on Objectives | Achieving the goal — theft, destruction, encryption, lateral movement |
Relationship to MITRE ATT&CK
- The Kill Chain is higher-level: seven coarse stages spanning the full lifecycle, with strong front-end (delivery/exploitation) emphasis
- ATT&CK is deeper and evidence-based: fourteen tactics with hundreds of techniques largely filling the post-compromise space the Kill Chain treats only as "Actions on Objectives"
- Common practice is to use them together: the Kill Chain for executive-level framing of the attack lifecycle, ATT&CK for technique-level detection and response detail
- The Unified Kill Chain (Pols, 2017) explicitly merges both into an 18-phase model covering pre- and post-compromise activity
Use in Defence
- Defence-in-depth: place detection and controls across every stage rather than assuming one control stops the intrusion
- "Left of boom": the front stages (recon → delivery) are where many intrusions can be interrupted before access is gained
- Indicator-based detection: each stage produces indicators (IPs, file hashes, domains, malware signatures) that feeds threat-intel and SIEM content
- Purple team / exercise framing: a shared vocabulary between red and blue teams on where an attack sits in the lifecycle
Limitations
- Designed around the malware-centric, exploitation-based intrusions typical of its 2011 origin — less natural for cloud, supply-chain, and insider/valid-credential intrusions that skip early stages
- Coarse granularity offers limited detection detail compared with Mitre Attack
- It models a single linear intrusion; real adversaries run multiple, overlapping chains
Australian Angle
The Kill Chain framing is standard in Australian security-operations and cyber-threat-intelligence tradecraft, including the intelligence products the CyberCX Assessments team delivers and the incident-response baselines referenced against the ACSC Essential Eight priority mitigation strategies. It pairs naturally with ATT&CK mapping for Australian government and critical-infrastructure clients.
Related Pages
- Mitre Attack — the technique-level successor/detail layer to the Kill Chain
- D3Fend — defensive countermeasures used to interrupt the chain at each stage
- Security Control Frameworks — control catalogues (Essential Eight, CIS, ISO) applied stage-by-stage
- Scattered Spider — a cybercrime group whose intrusions can be framed across the kill chain stages