When determining the priority of attacks based on the Cyber Kill Chain, which stage is crucial for early detection?

Question

Options

• AReconnaissance
• BWeaponization
• CInstallation
• DCommand and Control

• A
  90% (26)
• B
  3% (1)
• C
  7% (2)

Explanation

Reconnaissance is the stage to prioritize for early detection because it is the attacker's first step - where they gather information about the target before any malicious payload is built or delivered. Detecting and disrupting attacks here prevents the entire attack chain from progressing, offering the highest leverage with the least damage done.

Why the distractors are wrong:

• B. Weaponization happens entirely offline on the attacker's systems, making it nearly impossible for defenders to detect.
• C. Installation occurs after the payload has already been delivered and executed - detection here means a breach is already underway.
• D. Command and Control is even later in the chain; by this point the attacker has established a foothold, and detection means significant damage may have already occurred.

Memory tip: Think "earliest = best" - the Kill Chain flows left to right (Recon → Weaponization → ... → C2 → Actions on Objectives), and stopping an attacker at the leftmost stage you can detect is always the priority. Since Weaponization is invisible to defenders, Reconnaissance is your earliest actionable detection opportunity.

No community discussion yet for this question.