At what stage of the cyber kill chain theory model does data exfiltration occur?

In the Lockheed Martin Cyber Kill Chain model, 'Actions on Objectives' is the seventh and final stage where the attacker executes their intended goal - this includes data exfiltration, data destruction, encryption for ransom, or lateral movement. It only occurs after all prior stages (reconnaissance through C2) have been successfully completed.

Weaponization is the second stage where the attacker creates a deliverable payload (e.g., coupling an exploit with a backdoor), not where data is stolen.

Installation is the fifth stage where a remote access tool or backdoor is installed on the victim system to maintain persistence, not where data exfiltration occurs.

Command and Control (C2) is the sixth stage where the attacker establishes a communication channel to remotely control the compromised system, not where data is extracted.