An intrusion analyst is placing observed activity on the Cyber Kill Chain to decide where detection is weakest. Evidence so far: a malicious macro document was opened, a second-stage implant was written to disk, and the implant beaconed outbound every 60 seconds but no lateral movement or data staging has appeared. Which Kill Chain phase has the adversary MOST clearly reached?
- AActions on Objectives, because a second-stage implant was successfully written to the victim disk
- BDelivery, because a malicious macro document reached and was opened by the user
- CExploitation, because the macro executed code when the document was opened
- DCommand and Control, because the implant is beaconing to an external controller on a regular interval Correct
Why A is wrong: Tempting because the implant landing feels like a goal achieved, but writing a payload is installation, and no data theft or impact has occurred, so this phase is premature.
Why B is wrong: Tempting because the macro document is the delivery mechanism, but the adversary has clearly progressed past delivery to installation and beaconing, so naming delivery understates the furthest phase reached.
Why C is wrong: Tempting because macro execution is exploitation, but that phase is already complete and the beaconing places the adversary later in the chain, so this is not the furthest phase.
Why D is correct: Correct: a repeating outbound beacon to an external controller is the defining evidence of the Command and Control phase, which the 60-second interval demonstrates.