The Lockheed Martin Cyber Kill Chain describes seven sequential phases of a targeted cyber intrusion. During which phase does the attacker establish a persistent foothold on the victim system, typically by installing malware such as a backdoor?
In the Installation phase, the attacker's payload configures itself to run persistently-often by creating services, modifying startup items, or dropping additional malware. This foothold allows later Command and Control traffic and ultimately the attacker's Actions on Objectives. Weaponization occurs earlier (building the payload), Delivery transmits it to the target, and Exploitation triggers the code; none of these phases focuses on establishing long-term persistence.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is the purpose of the Installation phase in the Cyber Kill Chain?
Open an interactive chat with Bash
What is the difference between the Exploitation and Installation phases?
Open an interactive chat with Bash
What is a backdoor, and why is it used during the Installation phase?