Master the Lockheed Martin Cyber Kill Chain. Learn how to map post-compromise adversary behaviors—like MFA bypass and large-scale data exfiltration—to framework phases for better threat hunting.
You are a Threat Hunter at a prestigious law firm handling high-profile M&A cases. The firm recently suffered a catastrophic breach where confidential client documents were posted to a dark web ransomware leak site.
During your retrospective threat hunt, you are tracing the adversary's exact steps. You need to map the specific event where the data left the network to the Cyber Kill Chain to identify gaps in your current SIEM detection logic.
You pull telemetry from Azure AD (Entra ID) and the Palo Alto perimeter firewalls. Notice the sequence of the attack.
You are a Threat Hunter in the SOC team of a prestigious law firm specializing in high-profile corporate cases. Your firm has recently suffered a data breach, where confidential client documents were leaked on a dark web forum. As part of your proactive threat-hunting initiative, you analyze security logs, network traffic, and endpoint activity to trace the attacker's steps using the Cyber Kill Chain framework. Your investigation reveals that the attacker initially bypassed the firm's multi-factor authentication (MFA) by masquerading as a legitimate user. Once inside, they moved laterally within the internal network, accessed sensitive client records from a shared file repository, and exfiltrated the data over an extended period. You are tasked to identify the attack phase within the Cyber Kill Chain framework to strengthen defenses against similar attacks. Implement proactive threat hunting measures to detect future intrusions before data exfiltration occurs.
At which Cyber Kill Chain phase was the attack identified?
You are performing a post-incident retrospective. The adversary bypassed MFA (likely via an Adversary-in-the-Middle phishing proxy that stole the session token), moved to the file server, and funneled 40GB of client data out to a cloud storage provider. By mapping this exfiltration event to a threat framework, you can identify where your detection engineering failed.
Actions on Objectives is the final phase of the Cyber Kill Chain. This phase occurs *after* the attacker has established a foothold, escalated privileges, and set up C2. It represents the attacker actively executing the goal of their campaign—which, in this scenario, is the exfiltration of confidential client documents. Data theft, encryption (ransomware), and system destruction all fall squarely into this phase.
In a mature SOC, we don't just alert on malware; we build "choke point" detections for Actions on Objectives. Even if an attacker perfectly bypasses our EDR and C2 detections, they still have to move the data out. As a Senior Analyst, I expect my team to have alerts for things like: "Internal file server communicating with unknown external IP over port 443 where Bytes Out > 5GB in 1 hour." Detecting the exfiltration phase is often your last line of defense before a public breach notification.
The Lockheed Martin Cyber Kill Chain is a linear, 7-step model: Reconnaissance -> Weaponization -> Delivery -> Exploitation -> Installation -> Command and Control -> Actions on Objectives.
If we were using the MITRE ATT&CK framework instead, this scenario would map to multiple distinct tactics: Credential Access (stealing the MFA token), Lateral Movement (accessing the file repo), and Exfiltration (stealing the files). When taking the CSA exam, remember that "Actions on Objectives" is the Kill Chain's catch-all bucket for the adversary's ultimate goal.
Improve your threat detection and IR planning skills with more hands-on scenarios.
Explore more CSA simulations