Cyber Attack Lifecycle

Introduction

A cybersecurity attack is rarely a single event. It generally involves a series of activities through which an adversary develops an understanding of a target, identifies opportunities, gains access, expands control, and attempts to achieve a specific objective.

Understanding this progression is fundamental to cybersecurity because it helps explain how an attack begins, how information is gathered, how access is obtained, and how an adversary can progressively increase control over a target environment.

The Cybersecurity Attack Lifecycle is a broad conceptual model for understanding this progression. It should not be interpreted as a rigid sequence that every attack must follow. Different attacks may skip activities, repeat them, overlap several activities, or take different paths depending on the target and the adversary’s objectives.

Established frameworks such as the Cyber Kill Chain and MITRE ATT&CK provide additional perspectives on adversary activity. They will be discussed later in this article as complementary frameworks rather than as replacements for the broader lifecycle model.

Understanding the Cybersecurity Attack Lifecycle

The Cybersecurity Attack Lifecycle describes the major activities that may occur as an attack develops.

The lifecycle begins with the adversary attempting to understand the target. Information gathered during this stage can help identify exposed assets, technologies, services, and potential entry points. The adversary may then investigate those resources in greater detail, identify potential weaknesses, and attempt to establish an initial foothold.

After access is obtained, the attack may progress toward executing actions, increasing privileges, maintaining access, obtaining credentials, and expanding the adversary’s understanding and control of the environment.

The lifecycle therefore provides a way to connect individual attack activities rather than viewing them as isolated events.

Insert image: Overall Cybersecurity Attack Lifecycle. The visual should represent the lifecycle concept rather than reproduce the Cyber Kill Chain. Use a sophisticated, non-linear visual showing major attack activities and allowing for repetition or overlap.

Phases of the Cybersecurity Attack Lifecycle

The Cybersecurity Attack Lifecycle can be understood through a set of major phases that describe how an attack may progress from understanding a target to achieving an intended objective. These phases provide a conceptual framework for examining the activities that may occur during an attack, while recognizing that real-world attacks can repeat, overlap, or move between phases depending on the target and the adversary’s objectives.

Reconnaissance

Reconnaissance is the process of gathering information about a potential target before or during the early stages of an attack.

The objective is to develop an understanding of the target’s characteristics, infrastructure, technology, applications, services, personnel, and externally visible attack surface.

Information gathered during reconnaissance can help an adversary determine:

• What the target is
• What resources are associated with the target
• What technologies may be in use
• What systems or services may be exposed
• What potential entry points exist
• Which areas may require further investigation

Reconnaissance can involve both passive and active approaches.

Footprinting

Footprinting is the process of building an initial information profile of the target.

It can involve information about domains, IP address ranges, network infrastructure, technologies, applications, personnel, organizational structure, and publicly exposed resources.

Footprinting provides the broader picture from which subsequent discovery activities can be planned.

Passive Footprinting

Passive footprinting gathers information without directly interacting with the target infrastructure.

Information may come from publicly available sources, published documents, domain information, search engines, public records, technical databases, social platforms, and other external sources.

The important characteristic is that the information is obtained without actively probing the target systems.

Active Footprinting

Active footprinting involves direct interaction with target infrastructure to obtain information.

The interaction may provide information that cannot easily be obtained through public sources alone.

Because active interaction can generate observable activity on the target, it introduces a different level of exposure and should be distinguished from passive information gathering.

Scanning

Scanning is the process of identifying characteristics of systems, networks, and other technical resources.

In the context of attack activity, scanning commonly involves discovering:

• Reachable hosts
• Network ranges
• Accessible ports
• Available services
• Protocols
• Exposed systems
• Potentially vulnerable resources

Scanning therefore moves from a general understanding of the target toward more specific technical information.

For example, identifying an accessible port provides evidence that a service may be listening, but the port number alone does not necessarily establish which application or software is operating there.

Further enumeration may be required.

Passive Scanning

Passive scanning involves observing available network or system information without actively sending probes to the target.

The information may be derived from existing network traffic, available telemetry, or other observations.

Passive scanning can reduce direct interaction with the target but may provide less information than active probing.

Active Scanning

Active scanning involves sending probes or requests to systems or network resources to determine their characteristics.

It can be used to identify reachable hosts, ports, services, protocols, and other technical properties.

MITRE ATT&CK includes Active Scanning under its Reconnaissance tactic and documents techniques for gathering information through direct interaction with target infrastructure.

The distinction between passive and active scanning is therefore important when considering how information is obtained and how visible the activity may be to the target.

Enumeration

Enumeration goes deeper than basic discovery.

Once systems, ports, services, or applications have been identified, enumeration attempts to obtain more detailed information about them.

For example, enumeration may help determine:

• What service is operating
• What application provides the service
• What software version may be present
• What operating system may be involved
• What functionality is exposed
• What users or resources may be available
• What relationships exist between systems

Enumeration therefore transforms basic discovery information into a more detailed understanding of the target environment.

Passive Enumeration

Passive enumeration involves obtaining additional information without directly querying the target service.

The information may come from previously collected data, publicly available information, observed traffic, documentation, or other sources.

Active Enumeration

Active enumeration involves directly interacting with a service, application, or system to obtain additional information.

The interaction may reveal information that is not available through passive sources.

Active enumeration can therefore provide greater detail, but it also creates direct interaction with the target and may be more readily detected.

Vulnerability Analysis

Vulnerability analysis involves examining information obtained during reconnaissance, scanning, and enumeration to identify potential security weaknesses.

The objective is not simply to identify software or services. It is to understand whether those technologies, configurations, exposures, or relationships may introduce security weaknesses.

Potential areas of analysis include:

• Software vulnerabilities
• Misconfigurations
• Weak authentication mechanisms
• Excessive permissions
• Unnecessary exposed services
• Insecure protocols
• Outdated software
• Weak security controls
• Application weaknesses
• Architectural weaknesses

Vulnerability analysis therefore represents an important transition from information gathering to understanding potential security weaknesses.

Identifying Potential Vulnerabilities

Information obtained during earlier activities can be compared with known vulnerabilities, configuration weaknesses, security requirements, and expected security behavior.

The objective is to identify conditions that may require further investigation.

A potential vulnerability should not automatically be considered a confirmed vulnerability.

Analyzing Vulnerability Context

A vulnerability must be considered in the context of the system where it exists.

Important factors can include:

• Exposure
• Accessibility
• Authentication requirements
• Privilege requirements
• System role
• Network location
• Security controls
• Data sensitivity
• Dependencies

The same technical weakness can have very different security significance depending on its environment.

Assessing Potential Risk and Impact

Potential weaknesses can be evaluated according to their possible consequences.

Considerations may include:

• Confidentiality
• Integrity
• Availability
• Privilege implications
• Data exposure
• Operational consequences
• Business impact
• Possibility of further compromise

This analysis helps determine which findings require greater attention and which may have limited practical significance.

Initial Access

Initial Access represents the point at which an adversary successfully obtains an initial foothold in a target environment.

The transition from reconnaissance and vulnerability analysis to initial access is significant because the adversary moves from understanding the target to obtaining access to it.

Initial access may occur through different paths, including:

• Exploitation of vulnerabilities
• Compromised credentials
• Phishing
• Public-facing applications
• External remote services
• Trusted relationships
• Other weaknesses in access mechanisms

MITRE ATT&CK defines Initial Access as the adversary’s attempt to get into a target network and documents multiple techniques associated with achieving this objective.

It is important to distinguish exposure, vulnerability, and successful access.

An exposed service does not necessarily contain a vulnerability.

A vulnerability does not necessarily result in successful exploitation.

Successful exploitation does not necessarily provide broad control.

Initial access therefore represents an important milestone in the attack lifecycle, but it is often only the beginning of a larger intrusion.

Execution

After obtaining access, an adversary may need to execute code or commands within the target environment.

Execution concerns the ability to cause adversary-controlled instructions or code to run.

The significance of execution is that it allows the adversary to perform actions within the compromised environment rather than merely possessing a point of access.

Execution may involve operating-system functionality, scripting environments, applications, services, or other mechanisms.

The exact mechanism depends on the target environment and the type of access obtained.

Execution is also important because subsequent attack activities generally require some ability to perform actions within the environment.

Privilege Escalation

Initial access does not necessarily provide the level of access required to achieve the adversary’s objective.

Privilege escalation involves obtaining higher-level permissions than those initially available.

An adversary may attempt to move from a restricted account or process context toward greater control, such as:

• Administrative privileges
• System-level privileges
• Root-level access
• Highly privileged accounts
• Privileged application or service access

Privilege escalation can result from vulnerabilities, misconfigurations, excessive permissions, weak authentication, insecure privilege assignments, or abuse of legitimate functionality.

The importance of privilege escalation is that greater privileges can significantly expand what an adversary can access or modify.

Persistence

An adversary may also attempt to maintain access after the original entry point or session is no longer available.

Persistence refers to mechanisms that allow an adversary to retain access to a compromised environment over time.

Persistence may involve:

• Accounts
• Services
• Scheduled activities
• Startup mechanisms
• Application mechanisms
• Cloud resources
• Identity mechanisms

Persistence does not necessarily occur at one specific point in an attack.

An adversary may establish persistence after initial access, after privilege escalation, or at another point depending on the circumstances.

This illustrates why the Cybersecurity Attack Lifecycle should be understood as a dynamic model rather than a rigid sequence.

Credential Access

Credentials are valuable because they can provide access to systems, applications, accounts, and data.

Credential Access involves attempts to obtain authentication information such as:

• Passwords
• Password hashes
• Authentication tokens
• Session information
• Keys
• Other authentication material

Credential access can support several activities within an attack.

For example, compromised credentials may enable access to additional systems, support privilege escalation, provide persistence, or facilitate lateral movement.

Credential access should therefore be viewed as an important activity that can occur at different points in the lifecycle rather than as a stage that must always occur in one specific position.

This also demonstrates why the Cybersecurity Attack Lifecycle is not a rigid sequence: some activities can support multiple objectives and may recur throughout an attack.

Internal Discovery

After gaining an initial foothold, an adversary may need to understand the environment from within.

This activity is different from external reconnaissance. External reconnaissance focuses on information that can be obtained before access, while internal discovery concerns information available from a compromised system or environment.

Internal discovery may help identify:

• Systems and hosts
• Users and accounts
• Network structures
• Domain relationships
• Applications and services
• Security controls
• Shared resources
• Cloud resources
• Data repositories
• Critical systems

The information obtained through internal discovery can help an adversary determine where valuable resources exist and what additional access may be possible.

Internal discovery is often iterative. As an adversary gains access to additional systems, new information can become available, leading to further discovery.

Lateral Movement

An adversary who has gained access to one system may attempt to reach additional systems or resources.

This activity is known as lateral movement.

The objective is often to expand the adversary’s presence within the environment and reach systems that provide greater access, more valuable information, or greater operational significance.

Lateral movement may involve:

• Compromised credentials
• Remote services
• Existing trust relationships
• Administrative mechanisms
• Shared resources
• Other available communication paths

The significance of lateral movement is that an attack that begins with a single compromised system can develop into a broader compromise affecting multiple systems.

Lateral movement is closely related to internal discovery. An adversary may identify potential targets within the environment, move toward selected systems, and then perform additional discovery after reaching them.

Collection

Once valuable systems and information have been identified, an adversary may attempt to gather information relevant to the intended objective.

This activity is referred to as collection.

Collected information may include:

• Documents
• Databases
• Communications
• Credentials
• Configuration information
• Intellectual property
• Financial information
• Personal information
• Operational information
• Security-related information

The type of information collected depends on the objective of the attack.

Collection should be distinguished from exfiltration.

Collection concerns gathering information of interest.

Exfiltration concerns moving that information outside the target environment.

An adversary may therefore collect sensitive information without successfully exfiltrating it.

Command and Control

After compromising a system, an adversary may require a mechanism for communicating with it.

This activity is commonly described as Command and Control (C2).

Command and control provides a means through which an adversary can communicate with compromised systems and coordinate ongoing activity.

Depending on the circumstances, communication may support:

• Sending instructions
• Receiving information
• Coordinating multiple compromised systems
• Maintaining operational control
• Supporting additional attack activities

Command and control is therefore better understood as an enabling capability than as a single point in an attack.

It may support several activities during an intrusion and can remain relevant for as long as the adversary maintains control of compromised systems.

Exfiltration

When an attack involves the theft of information, the adversary may attempt to transfer collected data outside the target environment.

This activity is known as exfiltration.

The distinction between collection and exfiltration is important.

Collection concerns gathering information of interest, whereas exfiltration concerns moving that information outside the target environment.

The two activities may occur at different times. An adversary may collect information and retain it within the compromised environment before attempting to transfer it externally.

Exfiltration therefore represents an important transition from obtaining information to removing it from the target environment.

Impact

Not every cybersecurity attack is primarily intended to steal information.

Some attacks are intended to affect the availability, integrity, or operation of systems and data.

This broader objective is referred to as impact.

Potential impacts can include:

• Service disruption
• Data destruction
• Data encryption
• System destruction
• Manipulation of information
• Operational disruption
• Loss of availability
• Physical consequences in cyber-physical environments

The nature of impact depends on the adversary’s objective.

An attack may seek financial gain, information theft, disruption, sabotage, coercion, espionage, or other outcomes.

Impact therefore represents the point at which adversary activity produces consequences for systems, information, operations, or other assets.

The Attack Lifecycle Is Not Linear

Although the lifecycle provides a useful conceptual structure, real attacks do not necessarily progress through each activity once and in a fixed order.

An adversary may return to earlier activities as new information becomes available.

For example, after gaining access to one system, internal discovery may reveal additional systems that were not known during the initial reconnaissance. The adversary may then investigate those systems, obtain additional credentials, move to another system, and perform discovery again.

Similarly, persistence and privilege escalation may occur at different points depending on the circumstances.

Some activities can also support several objectives simultaneously. Credential access, for example, may contribute to initial access, privilege escalation, persistence, or lateral movement.

The lifecycle should therefore be understood as dynamic and iterative.

Insert image: Non-linear Cybersecurity Attack Lifecycle diagram showing major activities connected through multiple possible paths, with feedback into discovery and other earlier activities. Do not use a long one-directional arrow sequence.

Repetition and Overlap of Activities

Attack activities can overlap.

An adversary may perform discovery while also attempting to obtain credentials. Lateral movement may involve additional discovery. Collection may occur while command and control communication is active.

This overlap is important because cybersecurity incidents are rarely cleanly divided into isolated stages.

A single event may provide evidence of multiple activities.

For example, unusual authentication followed by access to several internal systems could potentially relate to credential access and lateral movement, while repeated system discovery could indicate continued internal reconnaissance.

Understanding these relationships helps security professionals analyze an attack as a connected set of activities rather than as unrelated events.

Returning to Earlier Activities

An adversary may repeatedly return to activities that were previously completed.

External reconnaissance may identify an initial target, but internal discovery after compromise may reveal additional targets.

Similarly, a newly discovered system may require further enumeration, vulnerability analysis, or credential investigation.

This creates an iterative process in which information obtained during one activity influences subsequent decisions.

The lifecycle therefore does not end each activity permanently once the adversary moves forward. Earlier activities can become relevant again as the environment changes or as new information becomes available.

Multiple Objectives Within an Attack

A single attack can involve multiple objectives.

An adversary may initially seek access to one system but later discover valuable information or additional opportunities.

The objective may change from obtaining initial access to establishing persistence, escalating privileges, collecting information, stealing data, or disrupting operations.

Different objectives can also exist simultaneously.

For example, an adversary may attempt to maintain long-term access while collecting information and moving toward a high-value system.

This reinforces the importance of viewing the Cybersecurity Attack Lifecycle as a flexible model of adversary activity rather than a fixed checklist.

Established Attack Frameworks

The Cybersecurity Attack Lifecycle provides a broad conceptual way to understand how cyber attacks can develop. Several established cybersecurity frameworks provide additional perspectives for studying adversary activity.

Two important frameworks are the Cyber Kill Chain and MITRE ATT&CK.

They should not be treated as interchangeable. The Cyber Kill Chain provides a high-level model of intrusion progression, while MITRE ATT&CK provides a detailed knowledge base for describing adversary behavior through tactics, techniques, sub-techniques, and procedures.

Cyber Kill Chain

The Cyber Kill Chain is a high-level intrusion model developed by Lockheed Martin. Its original model describes seven stages of a cyber intrusion:

• Reconnaissance
• Weaponization
• Delivery
• Exploitation
• Installation
• Command and Control
• Actions on Objectives

The model provides a simplified way to understand how an adversary can progress from preparing an attack toward achieving its objective. It also provides a way to consider where an intrusion may be detected or disrupted. Lockheed Martin’s material describes activities such as internal reconnaissance, privilege escalation, lateral movement, collection, exfiltration, and destruction within the broader progression toward the mission objective.

Its Seven Stages

Reconnaissance concerns gathering information about a target.

Weaponization concerns preparing an attack capability, traditionally described as combining an exploit with a payload.

Delivery concerns transmitting or introducing the prepared capability toward the target.

Exploitation concerns triggering a vulnerability or weakness to gain execution or access.

Installation concerns establishing a persistent presence on the target.

Command and Control concerns establishing communication that allows the adversary to interact with compromised systems.

Actions on Objectives concerns carrying out the mission or intended outcome, which may involve activities such as collecting information, exfiltrating data, modifying information, or disrupting systems.

The seven stages provide a useful high-level perspective, but they should not be interpreted as a complete description of every activity that can occur during a modern cyber attack.

Purpose and Use

The Cyber Kill Chain is particularly useful for understanding an intrusion at a high level.

It helps security professionals ask:

• Where is the adversary in the intrusion?
• What must happen for the attack to progress?
• Where might the attack be detected?
• Where could the attack be disrupted?
• What activities may indicate that an intrusion is progressing toward its objective?

Its strength is its simplicity. It provides a concise conceptual model that can help introduce attack progression before moving into more detailed frameworks.

Relationship to the Cybersecurity Attack Lifecycle

The Cybersecurity Attack Lifecycle used in this article is broader than the original Cyber Kill Chain.

The lifecycle provides a general educational model for understanding activities such as footprinting, scanning, enumeration, vulnerability analysis, initial access, execution, privilege escalation, persistence, internal discovery, lateral movement, collection, command and control, exfiltration, and impact.

The Cyber Kill Chain provides a different abstraction of intrusion progression.

Therefore, the two should be viewed as related but distinct models.

MITRE ATT&CK

MITRE ATT&CK is a knowledge base and framework for documenting adversary behavior based on real-world observations.

MITRE describes ATT&CK as a knowledge base of adversary behavior and organizes that behavior around concepts including tactics, techniques, sub-techniques, and procedures.

Unlike a simple linear attack sequence, ATT&CK provides a structured way to understand the different objectives and behaviors that adversaries may use during operations.

The current Enterprise ATT&CK model contains 15 tactics, including Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, and Impact.

Tactics, Techniques, and Sub-Techniques

Tactics represent the adversary’s objective or why an activity is performed.

For example, an adversary may want to gain access to a network, discover systems, obtain credentials, move through an environment, or exfiltrate information.

Techniques describe how an adversary can achieve a tactical objective.

Sub-techniques provide a more specific description of a technique.

Procedures describe specific implementations or observed examples of how adversaries use techniques or sub-techniques.

This structure allows ATT&CK to describe adversary behavior at considerably more detail than a high-level lifecycle model.

Purpose and Use

MITRE ATT&CK can be used to:

• Study adversary behavior
• Understand attack techniques
• Map observed activity
• Develop detection strategies
• Support threat intelligence
• Assess security controls
• Organize adversary emulation activities
• Improve incident analysis

The Enterprise ATT&CK Matrix organizes tactics and techniques across environments including traditional enterprise systems and cloud technologies.

Because ATT&CK is based on observed adversary behavior, it can provide a detailed vocabulary for describing what happens during different parts of an attack.

Relationship to the Cybersecurity Attack Lifecycle

The Cybersecurity Attack Lifecycle provides the broad conceptual view.

MITRE ATT&CK provides the detailed behavioral view.

For example, the lifecycle can introduce reconnaissance as an early activity in which an adversary gathers information about a target. ATT&CK can then provide a more detailed classification of reconnaissance behaviors, including Active Scanning and other techniques.

Similarly, the lifecycle can introduce discovery, lateral movement, collection, command and control, and exfiltration as broad activities. ATT&CK provides detailed techniques and sub-techniques that describe how adversaries can perform those activities.

The two therefore work well together:

The lifecycle explains the broader progression.

ATT&CK explains adversary behavior in greater detail.

Insert image: Conceptual comparison showing the Cybersecurity Attack Lifecycle, Cyber Kill Chain, and MITRE ATT&CK as three complementary perspectives. The lifecycle should be the central educational model, while the other two should appear as established frameworks that provide different levels of detail.

Conclusion

The Cybersecurity Attack Lifecycle provides a broad foundation for understanding how cyber attacks can develop from initial information gathering toward an intended objective.

An attack may begin with reconnaissance and progress through activities such as footprinting, scanning, enumeration, vulnerability analysis, initial access, execution, privilege escalation, persistence, credential access, internal discovery, and lateral movement. It may then involve collection, command and control, exfiltration, or impact depending on the adversary’s objectives.

These activities do not necessarily occur in a fixed sequence. An adversary may repeat earlier activities, perform multiple activities simultaneously, or change objectives as new information becomes available.

The lifecycle is therefore best understood as a conceptual model of adversary progression.

The Cyber Kill Chain provides a recognized high-level model for understanding intrusion progression, while MITRE ATT&CK provides a detailed knowledge base for understanding adversary tactics and techniques. The two frameworks offer different perspectives and should not be treated as replacements for one another.

Together, these concepts provide a strong foundation for studying cybersecurity attacks and threats and for understanding the individual activities that make up an attack.

References

MITRE – MITRE ATT&CK Enterprise Tactics
Provides the Enterprise ATT&CK tactical model and explains the adversary objectives represented by its 15 tactics.

MITRE – MITRE ATT&CK Get Started
Explains ATT&CK as a knowledge base of adversary behavior and describes its core concepts of tactics, techniques, sub-techniques, and procedures.

MITRE – MITRE ATT&CK FAQ
Provides foundational information about ATT&CK, its purpose, scope, and relationship to adversary behavior across the attack lifecycle.

MITRE – Enterprise Matrix
Provides the Enterprise ATT&CK Matrix and organizes adversary techniques according to tactical objectives across supported enterprise platforms.

Lockheed Martin – Gaining the Advantage: Applying Cyber Kill Chain Methodology to Network Defense
Provides the foundational Cyber Kill Chain model and describes its seven stages and their relationship to intrusion activity and mission objectives.