What is a Kill Chain?
The Cyber Kill Chain, told as a story about the seven steps every thief takes to rob a castle — and the chain that breaks if you cut just one.
The crown is gone. It looks like the thief came out of nowhere.The guard room only saw the crown leave. "When did they get in?" Nobody knows.
In fact, six steps came before that.Thieves don't appear out of nowhere. They count doors, send letters, build nests… and from the gate, none of those steps are visible.
A kill chain is the seven steps of a thief. Cut just one, and no crown.A thief can't skip a step. That's why it's a chain — break any link and they never reach the end.
Each step has a different friend who can cut it.Counting doors from outside, checking fake letters, the carpenter's plank, the guard dog, the corridor guard. Step 2 happens outside the castle where we can't see — so the real fight starts at step 3.
The chain says where; the encyclopedia says how.The chain has seven big steps, so you see at a glance where the thief is. The thief encyclopedia lists hundreds of habits for each step. Open both when chasing a persistent gang.
Kill chain = the seven steps every thief must take to reach the crown. Cut just one and they fail — and the earlier the cut, the less the castle gets hurt.
Lockheed Martin's seven-stage model of an attack — reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), actions on objectives — built on the idea that breaking any one stage stops the attack.
When grown-ups say it
- Cyber Kill Chain
- The seven steps to the crown. Linked like a chain, so breaking one link stops the whole thing.
- Reconnaissance
- Counting our doors from outside. Which doors are open, who lives here. → counting our doors from outside
- Weaponization
- Packing a bug into a gift box. Done outside the castle, so we can't see it. The bug → the bug in the gift box
- Delivery
- Sending it by letter. The most common route is a letter posing as the post. → the fake letter
- Exploitation · Installation
- In through the crack, then nesting. The crack → the hole nobody knows; the nest is what the guard dog sniffs out.
- Command and Control (C2)
- Signalling the boss out the window. The bug can't act alone; the boss outside gives orders. The corridor guard watches for this signal.
- Actions on Objectives
- Walking out with the crown. Stealing, breaking, or locking things up. The last line is → the red-stamp doorkeeper
- vs. MITRE ATT&CK
- The chain says where, the book says how. Seven big steps versus hundreds of habits per step. → the thief encyclopedia