View source for Cyber Kill Chain

The '''Cyber Kill Chain''' is a series of steps for tracing the stages of a cyberattack.<ref>[https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html Cyber Kill Chain, Lockheed Martin]</ref> The steps include: 
# Reconnaissance: Attackers assess the situation to identify targets and tactics.
# Intrusion: with [[malware]] or security vulnerabilities.
# Exploitation: of vulnerabilities to deliver malicious code into the system.
# Privilege Escalation: Attackers escalate their privileges to the level of Admin to gain access to data and permissions.
# Lateral Movement: Attackers move laterally to other systems and accounts, gaining leverage, higher permissions and more data and access.
# Obfuscation/Anti-forensics: Attackers cover their tracks with false trails, compromise data, and clear logs to confuse forensics teams.
# Denial of Service: Attackers disrupt access for users and systems to evade monitoring, tracking, or being blocked.
# Exfiltration: Attackers extract data from the compromised system.<ref>[https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force-Report.pdf 2021 RTF Report Glossary, pg. 74]</ref>

==History==
In 2011, Lockheed Martin released a paper defining a Cyber Kill Chain that was similar in concept to the U.S. military’s model.<ref>[https://www.sans.org/blog/applying-security-awareness-to-the-cyber-kill-chain/ Applying Security Awareness to the Kill Chain, Sans blog]</ref> Since then, organizations and companies have released various versions, including AT&T's "Internal Cyber Kill Chain Model"<ref>[https://cybersecurity.att.com/blogs/security-essentials/the-internal-cyber-kill-chain-model Security Essentials, Cybersecurity blog, AT&T]</ref> and Paul Pols' "Unified Kill Chain."<ref>[https://unifiedkillchain.com/ Unified Kill Chain]</ref>   

== References ==
{{reflist}}
[[Category:DNS Abuse Responses]]
[[Category:Glossary]]