Lion Cipher Lab
Explore the Cyber Kill Chain
- Threat Intel Analyst
- Beginner
- ~30 min
- Free · no account required
Why it matters
Before you can defend against an attack, you have to picture how one actually unfolds — and newcomers rarely do, because 'a breach' arrives in the news as a single event rather than the slow, multi-step campaign it really was. The Cyber Kill Chain is the classic model that turns that fog into a sequence: seven named stages an intruder moves through, from quietly researching a target to finally taking the data. Learning it does two things at once. It gives you a mental map for reading any incident ('where along this arc was the attacker when we caught them?'), and it delivers the single most…
What you'll learn
- the seven stages of the Lockheed Martin Cyber Kill Chain
- reading an intrusion as a sequence of stages
- naming a defensive control that breaks the chain at each stage
- the defence-in-depth idea that breaking one link stops the attack
- how the kill chain relates to and differs from MITRE ATT&CK
- the limits of a linear, perimeter-focused model and the assume-breach mindset
Steps in this lab
- What the Cyber Kill Chain is, in one breath
- The intrusion we'll walk through
- Stages 1-2: Reconnaissance and Weaponization (and how to break each)
- Stages 3-4: Delivery and Exploitation (and how to break each)
- Stages 5-7: Installation, Command and Control, and Actions on Objectives (and how to break each)
- The whole point: break one link, and layer your chances
- Now the honest critique: map it to ATT&CK, and see where it strains
- What you just learned to do — think like a defender