During the cyberattack lifecycle, which stage involves crafting a malicious payload designed to exploit a target's vulnerabilities and prepare it for deployment?

The Weaponization stage of the Cyber Kill Chain model is dedicated to creating the malicious tool to be used in the attack. This involves coupling an exploit, which takes advantage of a specific vulnerability, with a payload (e.g., a remote access trojan or backdoor). The outcome is a "weaponized" artifact, such as a malicious PDF or a Microsoft Office document with a harmful macro, that is prepared for the Delivery stage. This phase is purely about the adversary crafting and preparing their attack tool, not gathering information, delivering it, or executing the exploit on the target system.

A. Reconnaissance: This is the initial information-gathering phase where the adversary researches and selects targets, not the creation of a payload.
B. Exploitation: This stage occurs after delivery and involves the weaponized code being triggered to exploit the vulnerability on the target system.
C. Delivery: This is the transmission of the already-created weapon to the target, for example, via a phishing email or a compromised website.

1. Hutchins, E. M., Cloppert, M. J., & Amin, R. M. (2011). Intelligence-Driven Computer Network Defense Informed by Analysis of Adversary Campaigns and Intrusion Kill Chains. Lockheed Martin Corporation. In Section 3.2, "Weaponization," the authors state, "Weaponization is the first stage where an adversary creates a malicious payload to send to a victim." (Page 6).

2. University of Maryland Global Campus (UMGC). (n.d.). CMIT 424: The Cyber Kill Chain. Courseware. The course material defines Weaponization as: "Coupling an exploit and a backdoor into a deliverable payload. Adversaries must craft a payload that will exploit the vulnerability they discovered during reconnaissance."

3. SANS Institute. (2021). The SANS Survey of Cyber Threat Intelligence (CTI) Practice. In various SANS courseware and publications, the Cyber Kill Chain is a foundational concept. The Weaponization phase is consistently described as the process of creating a malicious payload and combining it with an exploit. For example, in the FOR578: Cyber Threat Intelligence course.

4. Dadfarnia, S. M. H., et al. (2021). A survey on cyber kill chain-based taxonomy of crypto-jacking. Journal of Information Security and Applications, 61, 102935. https://doi.org/10.1016/j.jisa.2021.102935. In Section 2, Table 1, the paper describes the Weaponization stage as: "Creating a malicious payload, by coupling an exploit with a backdoor into a deliverable payload."