SOC OperationsIncident ResponseWindows ForensicsLinux ForensicsKQL Investigations

Phase 1 - Gaining an Initial Foothold

The first phase of our unified kill chain of sophisticated cyber attacks explains the adversaries’ actions at the beginning of the breach. All activities included in phase 1 are performed on the initially compromised asset, as shown in the following figure:

Attack stages of phase 1

Jump In to view the stages in more detail:

PreviousUsing The Unified Kill Chain Model to Analyse Individual Cyber AttacksNextGaining Access to the Network

Last updated