The Lockheed Martin Cyber Kill Chain?breaks an attack lifecycle into several stages. A threat actor modified the registry on a compromised Windows system to ensure that their malware would…

Question

Options

• AAct on Objectives
• BExploitation
• CDelivery
• DInstallation

• A
  3% (1)
• B
  3% (1)
• C
  5% (2)
• D
  90% (35)

Explanation

Installation is correct because modifying the Windows registry to execute malware at boot is a persistence mechanism - the attacker is "installing" a foothold to survive reboots and maintain access beyond the initial compromise. This phase specifically covers actions that make the malware durable on the target system.

Why the distractors are wrong:

• B (Exploitation) - that phase covers the moment a vulnerability is triggered to gain initial code execution; the registry modification happens after the attacker already has access.
• C (Delivery) - delivery is how the payload reaches the victim (phishing email, malicious USB, drive-by download); it occurs much earlier in the chain.
• A (Act on Objectives) - this is the final phase where attackers achieve their end goal (data theft, destruction, ransomware deployment); establishing persistence is setup work that precedes it.

Memory tip: Think of Installation as "move in and unpack" - after breaking in (Exploitation), the attacker sets up so they can stay (persistence = registry keys, scheduled tasks, services). If the action makes malware survive a reboot, it's Installation.

No community discussion yet for this question.