Kill Chain V2 — a free Threat Intel tool on pranithjain.qzz.io. Browser-side security analysis, no signup required.
This is a free, browser-based threat intelligence platform on pranithjain.qzz.io. No signup required — all processing runs locally in your browser.
Lockheed Martin's 2015 extension of the 2011 Cyber Kill Chain. The original seven phases describe a single intrusion; v2 adds an explicit Lateral Movement phase -- post-exploitation is where modern intrusions actually live -- and a Campaign overlay, because one actor runs multiple intrusions in parallel. The key insight: the chain is per-intrusion, the campaign is per-actor.
The attacker harvests information about the target -- people, technology, infrastructure, partner networks, exposed services. Most of this is passive (OSINT) and indistinguishable from legitimate research, which is why the phase is so hard to detect.
An 8-step click-through using the Lazarus / Copperhedge sample already in the platform'sAI Report showcaseas the running example. Click a step to jump to that phase.
Step 1 of 8 · Reconnaissance
A partner feed + a CTF IoC report named Lazarus exploiting CVE-2025-55182. The WAF + load balancer logs show the list.txt scanning pattern hitting our Next.js 15.x prod apps.
Artifacts produced at this step
next: Weaponization
The Kill Chain is a content framework -- it describes what the adversary did. It does not replace ATT&CK, Diamond, or the process frameworks (F3EAD, F2T2EA, OODA); it feeds them.
| Note | |||||
|---|---|---|---|---|---|
| Cyber Kill Chain v2 | content | What phases did the intrusion pass through (incl. lateral movement)? | DFIR + SOC | /ti/kill-chain-v2 | The 7-phase chain plus lateral movement and a campaign overlay. |
| Lockheed Kill Chain | content | What phases did the intrusion pass through? | DFIR + SOC | /d/kill-chain | The original 7-phase chain -- v2 is the extension that fixes its blind spot. |
| Unified Kill Chain | content | How does the full campaign unfold across In / Through / Out? | CTI + DFIR + SOC | /ti/unified-kill-chain | The 18-phase meta-framework (Pols 2017) synthesizing the kill chain + ATT&CK. |
| F3EAD | process | How does the team operate end-to-end on a target? | CTI + SOC + IR | /ti/f3ead | The workflow the team runs; the kill chain describes what the actor did. |
| F2T2EA | process | How do we locate, track, and act on a target? | Ops + IR (targeting) | /ti/f2t2ea | Joint targeting cycle -- the ops side of the same fight. |
| OODA Loop | process | How fast can we decide and act? | IR + SOC (tempo) | /ti/ooda | Boyd's decision cycle -- the tempo at which the team runs the chain. |
| MITRE ATT&CK | content | Which specific techniques did the adversary use? | Detection eng + CTI | /ti/mitre | The shared vocabulary -- each chain phase maps onto ATT&CK tactics. |
| Diamond Model | content | Who did what to whom, and how? | CTI + IR | /d/diamond | Per-event reconstruction that fills in the who behind the chain. |
| ACH | process | Which hypothesis best explains the evidence? | CTI analysts | /ti/ach | Structured analytic technique used when the chain looks like more than one actor. |