December 2024 · 7 min read​​​

Recognizing and reporting cyberattacks promptly is vital for minimizing damage. The Attack Kill Chain framework helps users understand the typical stages of an attack.

7 Stages of Attack Kill Chain

1. Reconnaissance
   Description:
   Attackers gather information about the target, often through passive means, such as observing social media profiles or the company website.
   
   Sings to look for:
   i) Increased phishing emails or phone calls requesting sensitive information
   ii) Unusual interest in company operations from unknown contacts
   
   Advice:
   i) Do not share sensitive information
   ii) Report any suspicious communications to the IT security team
   iii) Avoid clicking links or attachments in unsolicited emails
   
   
   

2. Weaponisation
   Description:
   Attackers develop a malware payload designed to exploit known vulnerabilities in the target system. This phase is typically not observable.
   
   Advice:
   i) Stay vigilant by keeping all devices updated
   ii) Ensure that antivirus and malware protection software are current and functioning
   
   
   

3. Delivery
   Description:
   The attacker delivers the payload to the target system, commonly through email attachments, links, or physical devices like USB drives
   
   Sings to Look for:
   i) Unusual emails containing unexpected attachments or links
   ii) Strange USB drives found on site
   
   Advice:
   i) Avoid opening unexpected attachments or clicking links from unfamiliar sources
   ii) Report any strange devices or finds to IT security
   iii) Verify software updates through official sources only
   
   
   

4. Exploitation
   Description:
   The malicious payload triggers, granting the attacker access to the system.
   
   Sings to Look for:
   i) Slow system performance, crashes, or unusual error messages
   ii) Unauthorised changes to settings or unexpected software behaviour
   
   Advice:
   i) Immediately disconnect affected systems from the network
   ii) Report the issue to IT security without attempting to fix or reboot the system, as this could destroy evidence
   
   
   

5. Installation
   Description:
   The attacker establishes a backdoor for continued access to the system.
   
   Sings to Look for:
   i) New, unrecognised programs running on systems
   ii) Unexplained changes in system configurations or unusual network traffic
   
   Advice:
   i) Alert IT security promptly
   ii) Avoid using compromised systems for sensitive operations until they are cleared by security professionals
   
   
   

6. Command and Control
   Description:
   The attacker remotely controls the compromised system.
   
   Sings to Look for:
   i) Strange programs initiating or mouse cursor movement without user input (indicating remote control)
   
   Advice:
   i) Report these observations immediately to IT security
   ii) Disconnect the affected system from the network if possible
   
   
   

7. Actions on Objectives
   Description:
   The attacker achieves their goals, such as data theft, system disruption, or corruption.
   
   Sings to Look for:
   i) Large, unexplained data transfers, files being encrypted, or critical systems malfunctioning
   
   Advice:
   i) Notify IT security right away
   ii) Avoid paying ransom in ransomware situations, as this does not guarantee data recovery and could encourage future attacks

Conclusions

Awareness of cyberattack signs and the Attack Kill Chain empowers users to report threats swiftly. Timely communication with IT security helps address incidents early, bolstering organizational cybersecurity.

Are you facing challenges in your OT cybersecurity? Contact us for more information.