The Complete Attack Lifecycle

Every sophisticated attack follows a lifecycle. Understanding this progression helps both attackers plan operations and defenders anticipate threats. This page maps the complete journey from reconnaissance to consequences.

Attack Lifecycle Overview

┌─────────────────────────────────────────────────────────────────────────────┐
│                        THE ATTACK LIFECYCLE                                  │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│    ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐        │
│    │  RECON   │────►│WEAPONIZE │────►│ DELIVER  │────►│ EXPLOIT  │        │
│    │          │     │          │     │          │     │          │        │
│    │ Target   │     │ Build    │     │ Phishing │     │ Execute  │        │
│    │ Research │     │ Payloads │     │ Watering │     │ Code     │        │
│    └──────────┘     └──────────┘     └──────────┘     └──────────┘        │
│                                                              │              │
│    ┌──────────────────────────────────────────────────────────┘              │
│                                                                        │
│    ▼                                                                        │
│    ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐        │
│    │ INSTALL  │────►│   C2     │────►│ ACTIONS  │────►│  COVER   │        │
│    │          │     │          │     │          │     │  TRACKS  │        │
│    │ Persist  │     │ Control  │     │ Exfil    │     │          │        │
│    │ Beacon   │     │ Lateral  │     │ Ransom   │     │ Cleanup  │        │
│    └──────────┘     └──────────┘     └──────────┘     └──────────┘        │
│                                                              │              │
│    ┌──────────────────────────────────────────────────────────┘              │
│                                                                        │
│    ▼                                                                        │
│    ┌──────────────────────────────────────────────────────────────┐        │
│                    CONSEQUENCES                               │        │
│                                                               │        │
│   Success: Data stolen, ransom paid, access maintained       │        │
│   Failure: Attribution, arrest, prosecution, prison          │        │
│    └──────────────────────────────────────────────────────────────┘        │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘
                    COPY

Phase 1: Reconnaissance

Before any attack begins, operators gather intelligence about the target. This phase can last weeks or months for sophisticated campaigns.

• Chapter 26\ OSINT & Reconnaissance\ Target research, attack surface mapping
• Chapter 27\ Social Engineering\ Human intelligence, pretexting

Phase 2: Weaponization

Build the tools, infrastructure, and payloads needed for the operation. This happens entirely on attacker-controlled systems.

• Chapter 01\ Infrastructure\ Servers, domains, redirectors
• Chapter 02\ C2 Setup\ Command & control frameworks
• Chapter 04\ Payloads\ Implants, shellcode, evasion

Phase 3: Delivery & Exploitation

Get the payload to the target and execute it. This is the first moment the attacker touches the target network - detection risk begins here.

• Chapter 03\ Initial Access\ Phishing, exploits, entry vectors
• Chapter 05\ Execution\ Running code, LOLBins
• Chapter 15\ Privilege Escalation\ Getting SYSTEM/root

Phase 4: Installation & Persistence

Establish a foothold that survives reboots and detection. Multiple persistence mechanisms ensure continued access even if some are discovered.

• Chapter 06\ Persistence\ Surviving reboots, registry, services
• Chapter 07\ Beaconing\ C2 communication patterns

Phase 5: Command & Control

With persistence established, operators explore the network, steal credentials, and move laterally to reach high-value targets.

• Chapter 08\ Discovery\ Network and system enumeration
• Chapter 09\ Credential Access\ Password theft, Kerberoasting
• Chapter 10\ Lateral Movement\ Spreading through the network
• Chapter 17\ Active Directory\ Domain dominance

Phase 6: Actions on Objectives

The attacker's payday. Whether stealing data, deploying ransomware, or maintaining long-term access for espionage - this is what the operation was for.

• Chapter 11\ Exfiltration\ Stealing data
• Chapter 31\ Ransomware Operations\ Encryption, extortion
• Chapter 12\ Advanced Techniques\ Golden Ticket, SAML attacks

Phase 7: Covering Tracks

Smart attackers clean up after themselves. Log tampering, artifact removal, and counter-forensics techniques make attribution difficult.

• Chapter 29\ Anti-Forensics\ Log tampering, timestomping

Phase 8: Consequences

Every operation has an ending. Success means achieving objectives undetected. Failure means attribution, investigation, and potentially serious legal consequences.

• Chapter 30\ Attribution & Consequences\ Getting caught, legal ramifications
• Chapter 25\ Forensics & IR\ How investigators find you

Special Attack Types

Some attacks don't follow the standard lifecycle or have unique characteristics that warrant dedicated coverage.