Cyber Kill chain method

Question 1

1st step

Answer 1

Reconnaissance - The attacker or penetration tester gathers information about the target system or network, particularly vulnerabilities that can be exploited. There are several tools that are used during this phase, which could involve open-source intelligence (OSINT) research, passive and active port scanning of potential hosts, and footprinting resources found on those hosts. The attacker looks for information such as email addresses, user IDs, physical locations, operating systems, and applications used within the target network.

Question 2

2nd step

Answer 2

Weaponization – As the name suggests, the attacker develops weapons against the target network. The attacker or pen tester selects an attack vector, such as ransomware, viruses, or social engineering, to exploit the known vulnerability.

Question 3

3rd step

Answer 3

Delivery – The attacker uses the weapons and the chosen vector to launch the attack, such as delivering phishing emails with malicious links to targeted people. This phase is the first opportunity for defenders and cyber security professionals to identify the attack and block the attacker’s activities.

Question 4

4th step

Answer 4

Exploitation – If successful, the weapon exploits the identified vulnerability on the target system. A successful exploit gives the attacker access to move laterally through the system to find a new weakness or execute malicious code.

Question 5

5th step

Answer 5

Installation – The attacker enters the target system or network and installs the malicious payload. The attacker might use a command-line interface, a Trojan horse, or a backdoor to install malicious code or malware during this phase.

Question 6

6th step

Answer 6

Command and Control – The attacker establishes a two-way connection between the target and the attacker’s machine. The target system is compromised and under the control of the attacker. After gaining this access, the attacker may try to pivot to other resources in the network in an attempt to locate other vulnerable resources.

Question 7

7th step

Answer 7

Actions on Objectives – The attacker has full access to the target machine or system and carries out their intended actions (such as stealing confidential information, deleting data, destroying or altering systems, encrypting the system with ransomware, or installing malware).The final phase of the Cyber Kill Chain has the greatest impact and is the hardest to remediate .