# The Complete Attack Lifecycle

Every sophisticated attack follows a lifecycle. Understanding this progression helps both attackers plan operations and defenders anticipate threats. This page maps the complete journey from reconnaissance to consequences.

## Attack Lifecycle Overview

```
┌─────────────────────────────────────────────────────────────────────────────┐
│                        THE ATTACK LIFECYCLE                                  │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                             │
│    ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐        │
│    │  RECON   │────►│WEAPONIZE │────►│ DELIVER  │────►│ EXPLOIT  │        │
│    │          │     │          │     │          │     │          │        │
│    │ Target   │     │ Build    │     │ Phishing │     │ Execute  │        │
│    │ Research │     │ Payloads │     │ Watering │     │ Code     │        │
│    └──────────┘     └──────────┘     └──────────┘     └──────────┘        │
│                                                              │              │
│    ┌──────────────────────────────────────────────────────────┘              │
│                                                                        │
│    ▼                                                                        │
│    ┌──────────┐     ┌──────────┐     ┌──────────┐     ┌──────────┐        │
│    │ INSTALL  │────►│   C2     │────►│ ACTIONS  │────►│  COVER   │        │
│    │          │     │          │     │          │     │  TRACKS  │        │
│    │ Persist  │     │ Control  │     │ Exfil    │     │          │        │
│    │ Beacon   │     │ Lateral  │     │ Ransom   │     │ Cleanup  │        │
│    └──────────┘     └──────────┘     └──────────┘     └──────────┘        │
│                                                              │              │
│    ┌──────────────────────────────────────────────────────────┘              │
│                                                                        │
│    ▼                                                                        │
│    ┌──────────────────────────────────────────────────────────────┐        │
│                    CONSEQUENCES                               │        │
│                                                               │        │
│   Success: Data stolen, ransom paid, access maintained       │        │
│   Failure: Attribution, arrest, prosecution, prison          │        │
│    └──────────────────────────────────────────────────────────────┘        │
│                                                                             │
└─────────────────────────────────────────────────────────────────────────────┘
                    COPY
```

## Phase 1: Reconnaissance

Before any attack begins, operators gather intelligence about the target. This phase can last weeks or months for sophisticated campaigns.

- [Chapter 26\ OSINT & Reconnaissance\ Target research, attack surface mapping](/content/shadow/pages/26-osint-recon.html)
- [Chapter 27\ Social Engineering\ Human intelligence, pretexting](/content/shadow/pages/27-social-engineering.html)

## Phase 2: Weaponization

Build the tools, infrastructure, and payloads needed for the operation. This happens entirely on attacker-controlled systems.

- [Chapter 01\ Infrastructure\ Servers, domains, redirectors](/content/shadow/pages/01-infrastructure.html)
- [Chapter 02\ C2 Setup\ Command & control frameworks](/content/shadow/pages/02-c2-setup.html)
- [Chapter 04\ Payloads\ Implants, shellcode, evasion](/content/shadow/pages/04-payloads.html)

## Phase 3: Delivery & Exploitation

Get the payload to the target and execute it. This is the first moment the attacker touches the target network - detection risk begins here.

- [Chapter 03\ Initial Access\ Phishing, exploits, entry vectors](/content/shadow/pages/03-initial-access.html)
- [Chapter 05\ Execution\ Running code, LOLBins](/content/shadow/pages/05-execution.html)
- [Chapter 15\ Privilege Escalation\ Getting SYSTEM/root](/content/shadow/pages/15-privilege-escalation.html)

## Phase 4: Installation & Persistence

Establish a foothold that survives reboots and detection. Multiple persistence mechanisms ensure continued access even if some are discovered.

- [Chapter 06\ Persistence\ Surviving reboots, registry, services](/content/shadow/pages/06-persistence.html)
- [Chapter 07\ Beaconing\ C2 communication patterns](/content/shadow/pages/07-beaconing.html)

## Phase 5: Command & Control

With persistence established, operators explore the network, steal credentials, and move laterally to reach high-value targets.

- [Chapter 08\ Discovery\ Network and system enumeration](/content/shadow/pages/08-discovery.html)
- [Chapter 09\ Credential Access\ Password theft, Kerberoasting](/content/shadow/pages/09-credentials.html)
- [Chapter 10\ Lateral Movement\ Spreading through the network](/content/shadow/pages/10-lateral-movement.html)
- [Chapter 17\ Active Directory\ Domain dominance](/content/shadow/pages/17-active-directory.html)

## Phase 6: Actions on Objectives

The attacker's payday. Whether stealing data, deploying ransomware, or maintaining long-term access for espionage - this is what the operation was for.

- [Chapter 11\ Exfiltration\ Stealing data](/content/shadow/pages/11-exfiltration.html)
- [Chapter 31\ Ransomware Operations\ Encryption, extortion](/content/shadow/pages/31-ransomware.html)
- [Chapter 12\ Advanced Techniques\ Golden Ticket, SAML attacks](/content/shadow/pages/12-advanced.html)

## Phase 7: Covering Tracks

Smart attackers clean up after themselves. Log tampering, artifact removal, and counter-forensics techniques make attribution difficult.

- [Chapter 29\ Anti-Forensics\ Log tampering, timestomping](/content/shadow/pages/29-anti-forensics.html)

## Phase 8: Consequences

Every operation has an ending. Success means achieving objectives undetected. Failure means attribution, investigation, and potentially serious legal consequences.

- [Chapter 30\ Attribution & Consequences\ Getting caught, legal ramifications](/content/shadow/pages/30-attribution.html)
- [Chapter 25\ Forensics & IR\ How investigators find you](/content/shadow/pages/25-forensics-ir.html)

## Special Attack Types

Some attacks don't follow the standard lifecycle or have unique characteristics that warrant dedicated coverage.