The cyber kill chain is a model that describes an intrusion as a sequence of ordered phases. The idea, borrowed from military planning, is that an attacker must complete each step, so a defender who breaks any link can stop the attack.

The phases

• Reconnaissance and weaponization: the attacker researches the target and prepares a payload, such as a malicious document.
• Delivery and exploitation: the payload reaches the victim, for example by email, and runs by exploiting a flaw or the user.
• Installation and command and control: malware gains a foothold and connects back to the attacker.
• Actions on objectives: the attacker steals data, encrypts systems or moves deeper into the network.

The kill chain describes high-level objectives in a fixed order. MITRE ATT&CK works at a lower level of detail, and its tactics are not ordered, because real intrusions skip, repeat and revisit steps. The two models are often used together, see MITRE ATT&CK.

Why it matters for dark web monitoring

Many underground findings sit in the earliest phases. Leaked credentials, access offered for sale, or a discussion of a company’s exposed services are signs of reconnaissance or preparation. Acting at that stage, by resetting credentials or closing exposed services, stops an attack long before installation or data theft.

Sources: MITRE ATT&CK: FAQ, MITRE ATT&CK: Enterprise tactics