Kill Chain

An attack on a foreign computer system doesn’t happen in a single moment. It unfolds in several steps that build on one another. First, someone picks a target, then gains access, then causes damage. The kill chain is the technical term for this sequence of steps. The name originally comes from the military, where it describes the path from identifying a target to firing upon it. In computer security, the idea was adopted to better understand and stop attacks.

Why a chain is easier to break than a wall

The key idea behind the model is simple: the attacker must succeed at every step, while the defender only needs to prevent a single one. If a fake email already gets caught in the spam filter, it doesn’t matter how sophisticated the malware in the attachment was. The chain is broken at that point.

This changes the mindset in security departments. Previously, the focus was mainly on keeping intruders out. But that’s an all-or-nothing approach: once someone is in, they’ve won. With the kill chain model, defense is instead distributed across the entire process. Even if the first line of defense falls, there are further opportunities to notice the attack.

The model is also useful after an incident. Investigators map the traces they find to the individual steps. This shows them how far the attacker actually got. And it reveals at which point their own defenses failed.

The typical stages of an attack

The best-known version comes from the defense contractor Lockheed Martin and names seven stages. It begins with reconnaissance: the attacker gathers publicly available information about the target, such as employee names and email addresses from social networks. Next, they build their tool, usually a seemingly harmless file with hidden malicious code. This tool is then delivered, classically as an email attachment or via a rigged link.

If the victim opens the file, the malicious code exploits a security vulnerability in the program and launches itself. It then installs itself permanently on the computer so it survives a restart. Now it reports back to the attacker and waits for commands. Only in the final step does the actual goal happen: data is copied, encrypted, or deleted.

However, the model has a well-known weakness. It assumes an attacker who comes from outside and doggedly works their way from stage to stage. Real attacks often jump back and forth or start in the middle of the chain using stolen passwords. That’s why many experts today additionally work with MITRE ATT&CK, an open collection that catalogs observed attacker methods in much finer detail.

Kill chains in security products and headlines

The term regularly appears in reports about major hacking attacks. When it’s said that an attack was stopped early in the kill chain, it means no real damage occurred. If it was discovered late, the data had usually already been exfiltrated. Authorities such as Germany’s Federal Office for Information Security also use this language in their situation reports.

In the world of products, the kill chain is a fixed selling point. Monitoring software for corporate networks often displays an incident as a timeline with the detected stages. This lets a security team see at a glance whether it’s dealing with a blocked click on a phishing email or an attacker who is already executing commands.

The topic becomes even more interesting due to artificial intelligence. Language models can write deceptively authentic phishing emails in flawless German, significantly cheapening the early stages of the chain. On the other hand, learning systems analyze vast amounts of log data to detect suspicious patterns earlier. Both sides are thus working on the same chain, just with opposite goals.