During which Kill Chain stage is a backdoor installed to gain remote access?

During which Kill Chain stage is a backdoor installed to gain remote access?

• A. Delivery
• B. Exploitation
• C. Reconnaissance
• D. Installation

Answer: (D)

Establishing persistence and remote access happens during the installation stage. After the attacker has delivered the payload and exploited a vulnerability, the next step is to install the malware on the system. This installation creates the backdoor, a covert access point that remains on the host so the attacker can reconnect later and control the machine remotely. Without this installation, the attacker would likely have only a limited, short-term foothold. Reconnaissance is about gathering information to plan the attack, Delivery is the act of getting the payload to the target, and Exploitation is triggering the vulnerability to run code. The backdoor is specifically put in during the installation stage to establish persistent access.

Establishing persistence and remote access happens during the installation stage. After the attacker has delivered the payload and exploited a vulnerability, the next step is to install the malware on the system. This installation creates the backdoor, a covert access point that remains on the host so the attacker can reconnect later and control the machine remotely. Without this installation, the attacker would likely have only a limited, short-term foothold.

Reconnaissance is about gathering information to plan the attack, Delivery is the act of getting the payload to the target, and Exploitation is triggering the vulnerability to run code. The backdoor is specifically put in during the installation stage to establish persistent access.