In the Kill Chain, which stage includes spreading the infection to other end systems in the network after initial compromise?

In the Kill Chain, which stage includes spreading the infection to other end systems in the network after initial compromise?

• A. Delivery
• B. Exploitation
• C. Reconnaissance
• D. Installation

Answer: (D)

Spreading the infection to other end systems after the initial compromise happens during the installation phase. After a vulnerability is exploited and access is gained, the attacker installs malware on the compromised host to establish persistence and create a foothold. This installation often enables lateral movement, allowing the attacker to propagate to other machines in the network. The other stages occur earlier or in different contexts: delivery is how the payload reaches the target, exploitation is the act of taking advantage of a vulnerability to gain access, and reconnaissance is information gathering before the attack. So installation is the step that aligns with spreading to additional systems after initial access.

Spreading the infection to other end systems after the initial compromise happens during the installation phase. After a vulnerability is exploited and access is gained, the attacker installs malware on the compromised host to establish persistence and create a foothold. This installation often enables lateral movement, allowing the attacker to propagate to other machines in the network. The other stages occur earlier or in different contexts: delivery is how the payload reaches the target, exploitation is the act of taking advantage of a vulnerability to gain access, and reconnaissance is information gathering before the attack. So installation is the step that aligns with spreading to additional systems after initial access.