← All seven stages

Stage 4 / 7 · Trigger unauthorized behavior

Exploitation

Vulnerability exploitation, user execution, and trust or credential abuse that turn exposure into access.

90 readings · Guides can appear in more than one stage.

Understanding Exploitation

Exploitation is the triggering of behavior that gives the adversary an opportunity to run code or cross a security boundary. A software vulnerability is a common mechanism. In the broader intrusion story, user actions and failures of trust can also help turn delivered content into unauthorized execution.

Typical activities

Example: A crafted request reaches a vulnerable application and is followed by an unexpected child process. The request and process relationship are stronger evidence of exploitation than the presence of an unpatched version alone.

A vulnerability scan identifies a possible weakness; it does not prove successful exploitation. Credential guessing, stolen-account use, and permission abuse can provide access without exploiting a software flaw. Relevant guides include these adjacent access paths with that distinction preserved.

Defender’s question: Which request, input, or user action crossed the boundary, and what evidence shows that it succeeded?

Guides and articles by Andrey 87

Practical exercises 2

Attributed TrainSec readings 1

Public technical readings by the credited TrainSec authors. These link to the original canonical publications and are separate from Andrey’s original companion guides. Private course lessons are not reproduced here.

Authoritative external resources

Read Lockheed Martin’s Cyber Kill Chain for the stage definition, then use these primary technical references:

Defensive focus: Connect the triggering request or action to execution and identity evidence. Credential abuse is not automatically a software exploit.

Methods across stages

Use the CTI Analyst Field Manual for evidence and confidence, detection engineering guide for telemetry and validation, and practical learning paths for bounded exercises. These methods support several stages; they are not additional Kill Chain stages.

Source lifecycle, version boundaries, course access terms, and lab limitations still apply. Password recovery and lab exercises are learning analogues, not evidence of a real compromise.