← All seven stages

Stage 3 / 7 · Reach the target

Delivery

Email, web content, removable media, software updates, and other routes that bring an adversary-controlled artifact to a target.

27 readings · Guides can appear in more than one stage.

Understanding Delivery

Delivery is the point at which an adversary brings a malicious artifact or interaction to the target. It connects preparation to the environment the adversary wants to affect. The route can involve a message, a website, removable media, a trusted supplier, or a software distribution channel.

Typical activities

Example: An employee receives an email with an attachment. Mail and download records can establish arrival, but receiving or saving the attachment does not establish that its payload executed.

Delivery and exploitation can be close together, as with browser-based attacks, but they answer different questions: how did it reach the target, and what caused unauthorized behavior? Some identity or insider incidents do not involve a conventional delivered malware file.

Defender’s question: Which route brought the artifact or interaction to the target, and can we connect that arrival to subsequent activity?

Guides and articles by Andrey 25

Attributed TrainSec readings 2

Public technical readings by the credited TrainSec authors. These link to the original canonical publications and are separate from Andrey’s original companion guides. Private course lessons are not reproduced here.

Authoritative external resources

Read Lockheed Martin’s Cyber Kill Chain for the stage definition, then use these primary technical references:

Defensive focus: Correlate email, browser, download, and endpoint evidence to establish how an artifact arrived.

Methods across stages

Use the CTI Analyst Field Manual for evidence and confidence, detection engineering guide for telemetry and validation, and practical learning paths for bounded exercises. These methods support several stages; they are not additional Kill Chain stages.

Source lifecycle, version boundaries, course access terms, and lab limitations still apply. Password recovery and lab exercises are learning analogues, not evidence of a real compromise.