A malicious actor has gained access to an internal network by means of social engineering. The actor does not want to lose access in order to continue the attack. Which of the following best describes the current stage of the Cyber Kill Chain that the threat actor is currently operating in?

The scenario describes an attacker who has successfully used social engineering to gain initial access to the network. According to the Lockheed Martin Cyber Kill Chain model, the Exploitation phase involves leveraging a vulnerability to gain this initial access. In this case, the vulnerability is human trust, and the successful social engineering act is the exploit. The actor has just completed this phase and is now operating from within the network. The desire to "not lose access" is the motivation for the next phase, "Installation," where persistence is established, but the current stage described by the successful entry is Exploitation.

A. Weaponization: This is a pre-attack phase where the malicious payload (e.g., a phishing email with a malicious link) is created, which occurred before access was gained.
B. Reconnaissance: This is the initial information-gathering phase to identify targets and vulnerabilities, which happened long before the actor gained access.
C. Delivery: This phase involves transmitting the weapon to the target (e.g., sending the phishing email), which immediately preceded the successful exploitation.

1. Hutchins

E. M.

Cloppert

M. J.

& Amin

R. M. (2011). Intelligence-driven computer network defense informed by analysis of adversary campaigns and intrusion kill chains. Lockheed Martin Corporation. In the section "The Kill Chain

" the Exploitation phase is defined as "Once delivered

the weaponized code is triggered

exploiting a vulnerability...". The successful social engineering act is the trigger that exploits the human vulnerability.

2. National Institute of Standards and Technology (NIST). (2012). NIST Special Publication 800-61 Rev. 2

Computer Security Incident Handling Guide. Section 2.3.1

"Incident Response Life Cycle

" describes the phases of an attack which align with the kill chain model

where initial access (Exploitation) precedes actions to establish persistence.

3. SANS Institute. (2021). The SANS Survey of Cyber Threat Intelligence (CTI) Practice. The survey and associated SANS courseware (a reputable institution for cybersecurity training) heavily utilize the Cyber Kill Chain

defining Exploitation as the phase where an adversary's code is executed after being delivered. This aligns with the scenario where the social engineering tactic has succeeded.