← All seven stages

Stage 5 / 7 · Establish a foothold

Installation

Deployment of implants, backdoors, malicious components, or mechanisms that maintain access.

51 readings · Guides can appear in more than one stage.

Understanding Installation

Installation is the establishment of an adversary-controlled component in the compromised environment. An implant, backdoor, malicious extension, or web shell can give the operator a foothold from which to continue. The relevant evidence is the component and the changes that made it available for use.

Typical activities

Example: After an application compromise, a new web shell appears in a server directory. File-change records, application requests, and process events can help establish when it was placed and whether it was used.

Installation and persistence overlap, but are not identical. A newly deployed component may be temporary, and persistence can rely on identity or configuration changes rather than a conventional installed program. Memory-only activity may leave little durable file evidence.

Defender’s question: What new component or configuration established the foothold, and which evidence distinguishes it from an authorized change?

Guides and articles by Andrey 42

Attributed TrainSec readings 9

Public technical readings by the credited TrainSec authors. These link to the original canonical publications and are separate from Andrey’s original companion guides. Private course lessons are not reproduced here.

Authoritative external resources

Read Lockheed Martin’s Cyber Kill Chain for the stage definition, then use these primary technical references:

Defensive focus: Examine file, process, service, task, and configuration changes. Persistence can support installation, but the two are not synonyms.

Methods across stages

Use the CTI Analyst Field Manual for evidence and confidence, detection engineering guide for telemetry and validation, and practical learning paths for bounded exercises. These methods support several stages; they are not additional Kill Chain stages.

Source lifecycle, version boundaries, course access terms, and lab limitations still apply. Password recovery and lab exercises are learning analogues, not evidence of a real compromise.