Recognize scanning, probing, delivery attempts, and suspicious changes before a breach is confirmed.
01
Defense framework
The Cybersecurity Kill Chain
The Kill Chain defines the sequential stages an attacker must progress through to achieve an objective such as data theft, disruption, privilege escalation, or unauthorized control.
Modeling each stage allows security teams to move from broad, reactive protection to specific controls tied to specific attacker actions .
Connect policies, telemetry, detection logic, and response actions to individual attack stages.
Concentrate resources where interruption is most likely to prevent downstream impact.
Create overlapping opportunities to detect, contain, and stop an adversary throughout the sequence.
02
Attack progression
The seven stages of the Kill Chain
Each stage represents a distinct attacker objective. Understanding the progression makes monitoring, policy design, control placement, and incident response more precise.
01
Reconnaissance
Gathering intelligence about systems, people, infrastructure, exposed services, and potential weaknesses.
Observe scanning, enumeration, and information gathering.
02
Weaponization
Preparing an exploit, malicious payload, or attack package designed around discovered weaknesses.
Use vulnerability intelligence and attack-pattern awareness.
03
Delivery
Transmitting the attack through phishing, malicious links, compromised media, exposed services, or trusted channels.
Filter, inspect, challenge, and isolate inbound content.
04
Exploitation
Triggering a vulnerability or user action to gain execution, access, or an initial foothold.
Harden systems and correlate unusual execution behavior.
05
Installation
Establishing persistence through malware, backdoors, services, altered configurations, or unauthorized accounts.
Track file, service, account, and permission changes.
06
Command & Control
Creating a communication channel for remote control, tasking, lateral movement, and exfiltration.
Identify anomalous outbound traffic and unauthorized control paths.
07
Actions on Objectives
Executing the final goal, including theft, disruption, extortion, sabotage, or privilege escalation.
Contain activity, protect critical assets, and preserve forensic evidence.
03
Defensive strategy
Stop attacks at the earliest viable point
Every stage presents an opportunity to disrupt an adversary, but some stages offer greater defensive leverage. US ProTech emphasizes controls that expose or interrupt activity before exploitation and impact.
Reconnaissance
Detect external scanning, enumeration, probing, and repeated attempts to identify exposed systems or accounts.
Delivery
Filter, analyze, isolate, and challenge inbound content before it reaches users, applications, or infrastructure.
Command & Control
Identify and terminate suspicious outbound connections before an attacker gains durable control or removes data.
Anamo CDM-SIEM
See Indicators of Attack before they become compromise.
Host-based forensic telemetry provides direct visibility into internal changes that conventional perimeter monitoring may miss.
Anamo CDM-SIEM tracks granular activity across users, groups, permissions, transactions, software, vulnerabilities, and system state. This helps defenders distinguish normal change from suspicious behavior and act while the attack chain is still developing.
The result is objective, factual forensic visibility that supports faster analysis, lower dwell time, and earlier disruption.
Add, delete, and modify events involving users, groups, roles, and privileges.
Changes to access rights, configurations, transactions, and protected resources.
Software, exposure, and system-state changes that alter the organization’s risk posture.
Host-level evidence connected over time to reveal sequence, intent, and attacker progression.