← All seven stages

Stage 2 / 7 · Prepare the capability

Weaponization

Payloads, exploits, malicious documents, and compromised build artifacts prepared for an operation.

37 readings · Guides can appear in more than one stage.

Understanding Weaponization

Weaponization is the preparation or adaptation of a capability for use against the target. In the classic model, this often means combining an exploit with a payload and packaging it into a deliverable artifact. The capability may be developed, purchased, reused, or modified; it does not have to be novel.

Typical activities

Example: An attacker prepares a document containing malicious content before sending it. Preparing that artifact is weaponization; sending it is delivery; triggering its behavior belongs to the later execution or exploitation analysis.

Much of this work happens outside the defender’s environment. Recovered samples, build artifacts, and intelligence can reveal preparation, but imports, strings, and file structure indicate possible capabilities rather than proof that they ran.

Defender’s question: What was the artifact prepared to do, and which independent evidence would confirm those capabilities?

Guides and articles by Andrey 34

Practical exercises 1

Attributed TrainSec readings 2

Public technical readings by the credited TrainSec authors. These link to the original canonical publications and are separate from Andrey’s original companion guides. Private course lessons are not reproduced here.

Authoritative external resources

Read Lockheed Martin’s Cyber Kill Chain for the stage definition, then use these primary technical references:

Defensive focus: Study payload structure and provenance. Static capability clues support hypotheses; they do not prove execution.

Methods across stages

Use the CTI Analyst Field Manual for evidence and confidence, detection engineering guide for telemetry and validation, and practical learning paths for bounded exercises. These methods support several stages; they are not additional Kill Chain stages.

Source lifecycle, version boundaries, course access terms, and lab limitations still apply. Password recovery and lab exercises are learning analogues, not evidence of a real compromise.