Study guide
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK
TryHackMe Security Analyst Level 1 SAL1
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current SAL1 Exam Facts 1.2 24-Hour Window, Check-In, and Delivery 1.3 Scoring, Retakes, Validity, and Access 1.4 MCQ Section Strategy
2 SOC Simulator Exam Skills
2.1 Analyst VM, Splunk, and Dynamic Alerts 2.2 Classification and Escalation Scoring 2.3 Case Reports and Investigation Notes
3 Network Essentials
3.1 OSI, TCP/IP, Devices, and the Three-Way Handshake 3.2 HTTP, TLS, VPN, Web Browsing, and Email Transmission
4 Operating System Basics
4.1 Windows and Linux Architecture, Auth, Filesystems, Processes 4.2 Active Directory and Event Logs for Tracing Activity
5 Cryptography, Cloud, Web and Scripting Basics
5.1 Encoding, Encryption, Hashing, and Decoding Tools 5.2 VMs vs Hosts, Cloud vs Virtual Hosting, SaaS and IaaS 5.3 Web Apps, APIs, JSON/XML, Scripts vs Compiled Programs
6 Cybersecurity Fundamentals and MITRE ATT&CK
6.1 CIA, Least Privilege, Human Factors, Log4Shell, EternalBlue 6.2 Navigating MITRE ATT&CK: Tactics, Techniques, Sub-techniques 6.3 Mapping Real Attacks onto ATT&CK Techniques
7 Kill Chain, NIST CSF, and Attack Indicators
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK 7.2 NIST CSF: Identify, Protect, Detect, Respond, Recover 7.3 IoC vs IoA and the Pyramid of Pain
8 Social Engineering and Network Attacks
8.1 Phishing: Impersonation, Typosquatting, Spoofing, Header Analysis 8.2 SPF, DKIM, DMARC, and Email Authentication Results 8.3 Port Scanning, DDoS, and Man-in-the-Middle 8.4 DNS Poisoning, ARP Spoofing, Exfiltration, and C2 Traffic Patterns
9 Web Exploitation and Endpoint Attacks
9.1 Client vs Server Vulnerabilities, XSS, and SQL Injection 9.2 Code Injection, Path Traversal, Input Validation, Patching, WAF 9.3 Initial Access (RDP/SSH), Persistence, Privilege Escalation 9.4 Credential Theft, Mimikatz, Sysmon, and Auditd
10 Command and Control, Malware, and LOLBAS
10.1 Forward vs Reverse Shells, Beaconing, Metasploit, Cobalt Strike 10.2 Malware Types, Static vs Dynamic Analysis, LOLBAS
11 EDR, Firewalls, and WAF
11.1 EDR vs AV, Telemetry, Containment, Remote Shell 11.2 Firewall Deployments, Limits, and Log Analysis 11.3 WAF Capabilities, Limits, and Rule Creation
12 SIEM and SOAR
12.1 SIEM Deployments, Parsing, and Raw Logs to Alerts 12.2 Alert Management, Threat Hunting, Triage, Reporting 12.3 SOAR Playbooks, Enrichment, and TI Integration
13 Threat Intelligence and Vulnerability Scanning
13.1 Feeds, Indicators, Classifying IPs, Domains, and Hashes 13.2 YARA and TI Integration with SIEM/SOAR 13.3 External vs Internal, Web vs Network Scanning
14 SOC Team, Activities, and Alert Triage
14.1 Blue/Red Teams, Hierarchy, and SOC Roles 14.2 Proactive vs Reactive: FP Remediation, Detection Engineering, Tabletop, DFIR, Threat Hunting 14.3 Workbooks; Ticket vs Alert vs Detection Rule 14.4 Triage Workflow, Severity, Status, and Verdicts
15 SOC Metrics, Escalation, and Communication
15.1 MTTA, MTTD, MTTR, SLA, and Lookups 15.2 Escalation Matrix, Urgent Remediation, and Cross-Team Communication
7.1 Cyber Kill Chain Stages vs MITRE ATT&CK
Key Takeaways Explain This Topic AI
Lockheed Martin's Cyber Kill Chain uses seven stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, and Actions on Objectives.
The model's purpose is to show that an attacker generally needs the chain to succeed, while a defender can break the intrusion at any one stage.
Weaponization almost always happens on attacker infrastructure, so victim logs rarely show that stage.
MITRE ATT&CK catalogs adversary behaviors (tactics and techniques) in a matrix; it is not a required linear sequence the way the Kill Chain is taught.
A phishing-macro-C2 incident can be told as seven Kill Chain stages and as ATT&CK techniques such as T1566.001, T1204.002, T1547.001, and T1071.001.
Last updated: September 2026
Why analysts still learn the Cyber Kill Chain
In 2011, Lockheed Martin researchers Eric Hutchins, Michael Cloppert, and Rohan Amin described an intrusion kill chain in Intelligence-Driven Computer Network Defense . The public name is the Cyber Kill Chain : seven stages an adversary typically progresses through to finish a network intrusion. The official stages are Reconnaissance , Weaponization , Delivery , Exploitation , Installation , Command & Control (C2) , and Actions on Objectives .
The purpose is practical, not decorative. First, the attacker generally needs the chain to succeed—especially through C2—before they can reliably complete the mission. Second, the defender can stop the intrusion by interrupting any stage with a control that actually fires. That defender-favored math is why entry-level analysts still use the model as a storytelling and triage frame.
This section is independent study material covering Security Analyst Level 1 (SAL1) topics. TryHackMe SAL1 training content lists the Cyber Kill Chain as its own topic: know the stages, know the purpose for understanding attacks, and know how the model differs from the MITRE ATT&CK Framework.
- The seven stages
- Reconnaissance
The adversary researches and selects targets. Passive reconnaissance uses job ads, conference speaker lists, DNS and certificate-transparency logs, leaked credential dumps, and social media. Active reconnaissance touches the target: port scans, noisy crawling, or password spraying a VPN. Passive work rarely lights up a Security Operations Center (SOC) queue. Active work may show as scanning detections, but many campaigns finish Reconnaissance entirely off your network.
Output of the stage: email naming patterns, who approves invoices, which VPN the help desk mentions in public posts, and which file types finance actually opens.
Weaponization
The adversary builds the deliverable on their own systems . The Lockheed Martin paper describes coupling a remote-access trojan with an exploit inside a client document (Office or PDF) using an automated weaponizer . A modern analogue is a builder that injects a Visual Basic for Applications (VBA) macro or packages a loader. You will almost never log Weaponization. Exam trap: do not pick Weaponization merely because malware exists. Ask whether the step happened before the payload left the attacker.
Delivery
The weapon is transmitted into the target environment. The original paper's common channels were email attachments, websites, and USB removable media. Delivery is the first stage that commonly creates your artifacts: an email-gateway log, a proxy GET to a malware site, or a USB insertion event.
Exploitation
Intruder code is triggered . That may exploit a software vulnerability, an insecure auto-execute feature, or the user (Enable Content / Open this PDF). After Exploitation, attacker-controlled instructions are running. Before Exploitation, you still have a hostile file sitting still.
Installation
A backdoor or remote-access component is planted so access survives logoff or reboot: an AppData drop plus a Registry Run key, a scheduled task, a service, a startup-folder shortcut, or a browser extension. Exploitation is a moment. Installation is a beachhead.
Command & Control
The implant phones home so operators gain interactive control (hands on the keyboard). Beacons may use HTTPS to a look-alike domain, DNS queries, or popular cloud APIs. Without C2, many payloads cannot receive new tasks. With C2, later objectives become remote operations rather than a one-shot script.
Actions on Objectives
Only now does the mission happen: copy databases, encrypt files, destroy backups, or treat the first host as a hop into the rest of the network. The Kill Chain bundles a large amount of internal activity here, which is one reason analysts also learn ATT&CK.
Purpose during triage
Use the chain to:
Place an alert in the story (this is Delivery, not C2).
Ask what evidence should exist one stage earlier and one stage later.
Choose a control that interrupts the path you actually have (blocking internet macros at Delivery/Exploitation is cheaper than hashing a sample after data is gone).
Brief non-SOC stakeholders in a linear narrative.
The chain is a lifecycle model , not a packet decoder. Real intrusions loop, skip stages, or run several chains in parallel (one chain for initial access, another for ransomware deployment).
Stage What the adversary does Typical defender-visible trace Example interrupt
Reconnaissance Research and select targets Often none; sometimes scan noise Reduce public org charts; rate-limit scanners
- Weaponization Build the payload offline Almost never in victim logs Intel may later identify a builder family
- Delivery Transmit the weapon Mail gateway, proxy, USB logs Sandbox attachments; block macros from the internet
Exploitation Trigger code execution Office/reader child processes Exploit protection; disable risky Office features
Installation Plant persistence New Run key, task, service Alert on persistence locations
Command & Control Open a remote-control channel Beacons, new domains, odd DNS Egress filtering; beacon analytics
Actions on Objectives Steal, encrypt, destroy, or pivot Staging archives, ransomware notes, lateral auth Data-loss controls; privileged-access monitoring; isolated backups
Contrast with MITRE ATT&CK
MITRE ATT&CK is a knowledge base of adversary behaviors . Tactics answer why the adversary is acting (get in, stay in, steal data). Techniques and sub-techniques answer how. Procedures are specific implementations (this group's macro plus this C2 family). ATT&CK is a matrix : many techniques sit under each tactic, and real operations jump around. Credential theft can precede discovery. Impact (ransomware) can skip quiet exfiltration.
- Question Cyber Kill Chain MITRE ATT&CK
- What is it? Seven-stage intrusion lifecycle Catalog of tactics, techniques, and procedures
- Order Taught as a sequence the attacker wants to complete Not a required sequence
Best analyst sentence Where are we in this attack story? Which named behavior are we seeing?
- Attacker-side prep Weaponization (usually invisible) Resource Development (malware, domains, accounts)
- Getting in Delivery then Exploitation Initial Access plus Execution
- Staying in Installation Persistence (privilege escalation is a separate tactic)
- Remote control Command & Control stage Command and Control tactic with many protocol techniques
- The mission Actions on Objectives Collection, Exfiltration, Impact, plus Discovery and Lateral Movement
- Detection grain Stage labels Technique IDs such as T1566.001
A Kill Chain limitation you should be able to explain: after Installation, a huge amount of real work—privilege escalation, lateral movement, credential dumping—gets stuffed into one bucket. ATT&CK's extra tactics exist because defenders need those labels to write detections. The Kill Chain remains useful for briefings and for remembering that early breaks (Delivery, Exploitation) are cheaper than recovering from Actions on Objectives.
ATT&CK Resource Development is the closest cousin to Weaponization. Initial Access overlaps Delivery plus the start of Exploitation. Execution covers Exploitation's code-ran moment. Persistence overlaps Installation. Command and Control shares a name with the Kill Chain stage but is a tactic with many techniques. Exfiltration and Impact split what the Kill Chain bundles as Actions on Objectives.
SAL1 training content compares the Cyber Kill Chain with MITRE ATT&CK. It does not treat expanded multi-stage unified kill-chain variants as training-content topics. Do not spend exam time mapping extra unofficial stages. Map Lockheed Martin's seven against ATT&CK behaviors.
Worked case: phishing, macro, C2
Facts. Maya in accounts payable receives Q3-Invoice-8891.xlsm from billing@vend0r-payments.example . The legitimate supplier uses vendor-payments.example . She clicks Enable Content. Endpoint detection later records EXCEL.EXE spawning wscript.exe , then update.exe in %APPDATA%\Microsoft\Templates\ . A Registry value HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OfficeTemplateUpdate points at that path. The host beacons over HTTPS every 60 seconds to invoices-update.example . Before containment, \\filesrv01\finance\export.zip appears.
Kill Chain mapping
Reconnaissance. Attackers collected Maya's address from a conference speaker PDF and learned invoice file types from a public how-we-pay-vendors page. No hospital sensor saw this.
Weaponization. A builder produced the .xlsm with an auto-open VBA dropper on attacker infrastructure.
Delivery. The message traversed SMTP; the email security gateway logged the attachment and the look-alike sender domain. This is the first defender-visible stage.
Exploitation. Enable Content caused VBA to run—human exploitation plus Office as the execution host.
Installation. update.exe plus the Run key. A reboot would still call back.
Command & Control. Periodic HTTPS to invoices-update.example —the operator channel.
Actions on Objectives. Staging export.zip on the finance share is collection toward theft (or a precursor to encryption).
ATT&CK mapping of the same facts
Resource Development: malware construction; registering invoices-update.example and the look-alike sender domain.
Initial Access: T1566.001 Phishing: Spearphishing Attachment.
Execution: T1204.002 User Execution: Malicious File, and T1059.005 Command and Scripting Interpreter: Visual Basic.
Persistence: T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder.
Command and Control: T1071.001 Application Layer Protocol: Web Protocols.
Collection / Exfiltration: archive staging on a file share; likely transfer over the existing C2 channel (T1041) if the zip left the network.
Same incident, two vocabularies. The chain tells the story in order and highlights that Weaponization never hit a hospital log. ATT&CK names detections you can reuse next week: any user execution of macros, any new HKCU Run key, any new periodic HTTPS beacon—not only this invoice filename.
Analyst traps
Calling the email Exploitation. The email arriving is Delivery; Exploitation starts when the macro or exploit runs.
Assuming every intrusion shows all seven stages in your logs. Weaponization almost never does; Reconnaissance often does not.
Treating C2 as the mission. C2 is the remote-control channel; the mission is Actions on Objectives.
Forcing lateral movement into Installation. Installation is the beachhead on a host; moving to a domain controller is later behavior that ATT&CK models more clearly.
Mixing framework names: do not dump ATT&CK technique IDs into a Kill Chain stage list as if they were the seven stage names.
When an alert lands, ask two questions in order: Where are we on the chain? Which ATT&CK technique does this look like? That dual mapping is the skill SAL1 training content is after.