Library / Cyber Kill ChainThe research library, connected
Follow the Cyber Kill Chain Find the right guide for the part of an attack you want to understand, investigate, or detect.
Seven classic stages. 169 original guides, articles, and exercises, plus selected attributed readings. Each banner opens a dedicated reading path.
01 Understand the target Reconnaissance Target selection, public exposure, asset discovery, and the intelligence that makes an intrusion possible. 53 readings ↗ 02 Prepare the capability Weaponization Payloads, exploits, malicious documents, and compromised build artifacts prepared for an operation. 37 readings ↗ 03 Reach the target Delivery Email, web content, removable media, software updates, and other routes that bring an adversary-controlled artifact to a target. 27 readings ↗ 04 Trigger unauthorized behavior Exploitation Vulnerability exploitation, user execution, and trust or credential abuse that turn exposure into access. 90 readings ↗ 05 Establish a foothold Installation Deployment of implants, backdoors, malicious components, or mechanisms that maintain access. 51 readings ↗ 06 Coordinate the operation Command and Control Channels through which an operator or infrastructure communicates with compromised systems. 38 readings ↗ 07 Pursue the intended outcome Actions on Objectives Theft, espionage, disruption, destruction, encryption, fraud, and other mission outcomes. 64 readings ↗ Use the model with care The classic seven stages of Lockheed Martin’s Cyber Kill Chain are an organizing model, not a mandatory linear sequence. Stages can repeat, overlap, be skipped, or remain unobserved. Fileless, insider, identity, cloud, and AI attacks may not fit every stage. A reading association is not proof that an observed attack completed that stage.
MITRE ATT&CK describes adversary behaviors and tactical goals at a different level of detail. Its tactics are not interchangeable with these stages. The external technique links below are learning associations, not an official one-to-one mapping.
Start with CTI Kill Chain: An Analyst Guide With Real-World Evidence for case evidence and analytic limits, or the original framework reference (PDF) .
Methods across stages Use the CTI Analyst Field Manual for evidence and confidence, detection engineering guide for telemetry and validation, and practical learning paths for bounded exercises. These methods support several stages; they are not additional Kill Chain stages.
Source lifecycle, version boundaries, course access terms, and lab limitations still apply. Password recovery and lab exercises are learning analogues, not evidence of a real compromise.
Coverage and editorial choices Reviewed 2026-10-27: all 194 articles in the site’s pinned archive, standalone guide and learning records, and the 87 public TrainSec readings. We classify by technical substance and retain a relevance note for every placement. Generated reference entities, generic setup pages, product announcements, and unrelated foundations are not forced into a stage.
Public TrainSec companion articles appear under Andrey’s guides where relevant; attributed TrainSec originals have their own section. No separate “express guides” collection was found.
Download the complete coverage and exclusion register (JSON) · Browse the full Library · Browse the Article Archive · Browse the attributed TrainSec Library .