[Figure: FiveStudy logo]
FiveStudy
Cybersecurity · Unit 2 · 2.1.c
AP Cybersecurity · Securing Spaces
Phases of a Cyberattack
Six stages an adversary may work through — and the evidence each one leaves behind.
key ideaSix phases, in order — but not every attack uses every phase.
exam-day recap
- The six phases: reconnaissance, initial access, persistence, lateral movement, taking action, and evading detection.
- Reconnaissance: the adversary gathers information, much of it open source intelligence (OSINT).
- Initial access: the two routes named by the CED are social engineering and compromised or weak credentials.
- Persistence: the adversary may install a command and control (C2) channel to keep access without repeating the work.
- Lateral movement: escalate privileges by reaching computers and accounts with elevated permissions to services and data.
- Taking action: collecting the targeted data, exfiltrating it, and disrupting services or destroying data.
- Evading detection: removing or editing log files and erasing planted files such as malware.
- The absence of evidence can itself be evidence; treat an unexplained gap in logs as a sign of attack, not a fault.
- The CED states the phases may not all be used in every attack; a misconfiguration can collapse the model into two.
The stages
Cyberattacks aim to disrupt, harm, steal or destroy devices, networks or data. Knowing the phases lets a defender say where evidence belongs, and place controls that interrupt a specific step — not a checklist every attack completes.
Read it as a sequence an adversary may follow — catching them at persistence means the damage phase has not happened yet.1
Reconnaissance
The adversary gathers as much information as possible, much of it open source intelligence (OSINT) — staff names and roles, job adverts naming internal software, social posts, public DNS records. Nothing here is illegal or noisy.
produces targets, names, technologies defender sees little or nothing
2
Initial access
The adversary establishes a foothold on the target's computer. The two routes named by the CED are social engineering and compromised or weak credentials — which is why Units 1 and 4 matter here: phishing and password attacks are how most intrusions begin.
produces a foothold defender sees an odd login, a clicked link
3
Persistence
Having got in, the adversary makes sure they can get back in without repeating the work. They may install a command and control (C2) channel to send instructions to the compromised device and receive data back. Persistence is what turns a one-off intrusion into an ongoing one.
produces durable access, C2 channel defender sees beaconing traffic
4
Lateral movement
The adversary moves sideways through the network, trying to escalate privileges by reaching computers and user accounts with elevated permissions to services and data. The account they first compromised is rarely the one they need.
produces higher privilege defender sees unusual internal access patterns
5
Taking action
The adversary acts on their objectives: collecting the targeted data, exfiltrating it, and disrupting services or destroying data. This is the phase whose damage the organization actually feels.
produces the impact defender sees large outbound transfers, outages
6
Evading detection
Many adversaries finish by covering their tracks — removing or editing log files and erasing files they planted, such as malware. This is why log integrity matters: the absence of evidence can itself be evidence.
produces a cleaned scene defender sees gaps in logs
| Phase | Adversary's goal | A control that interrupts it |
|---|
| Reconnaissance | learn about the target cheaply | limit what is published; train staff on oversharing |
| Initial access | get a foothold | MFA, phishing training, strong password policy |
| Persistence | keep access without redoing the work | monitor for C2 beaconing; endpoint detection |
| Lateral movement | escalate privilege | least privilege, network segmentation |
| Taking action | collect, exfiltrate, disrupt, destroy | data-loss prevention, backups, egress monitoring |
| Evading detection | erase the trail | centralized, append-only log storage off the host |
Defense in depth means placing controls at several phases — so that failing to stop initial access does not mean losing the data.
Applying it
The examination skill is to take a described incident and say which phase each observation belongs to, then reason about what must have come before and what may come next.
Worked analysis
EX 1
Map an incident to the phases
A lecturer got an email quoting their exact job title and current project, then entered credentials on a linked page. Two weeks later an IT department account first reached the student-records server. Then 40 GB left overnight, and days of authentication logs went missing. Assign phases.
1
The tailored detail
Knowing the job title and current project is reconnaissance — almost certainly OSINT from the university's own staff and research pages.
2
The credential entry
Entering credentials on the attacker's page gives the adversary a foothold: initial access via social engineering.
3
The two-week gap
The delay implies the adversary maintained access rather than re-phishing. That is persistence, likely with a C2 channel.
4
The IT account reaching records
A different, more privileged account touching a sensitive server is lateral movement with privilege escalation — the lecturer's account would not have that reach.
5
The 40 GB transfer
Collection and exfiltration of the targeted data: taking action.
6
The missing logs
Deleting authentication logs is evading detection. The gap is itself an indicator — report it rather than assume a logging fault.
EX 2
An attack that skips phases
An adversary scans the internet for exposed databases, finds one with no password, downloads its contents, and leaves. Which phases occurred, and which did not?
1
Reconnaissance
Yes — the internet-wide scan is reconnaissance, though untargeted rather than aimed at one organization.
2
Initial access
Yes, but trivially: the database required no credentials, so the foothold and the objective were the same asset.
3
Persistence
No. The adversary did not need to return; nothing was installed to maintain access.
4
Lateral movement
No. The data was already reachable, so no privilege escalation was necessary.
5
Taking action and evasion
Taking action: yes, the data was collected and exfiltrated. Evading detection: not attempted — the adversary simply left.
6
The point
The CED states explicitly that the phases “may not all be used in every attack.” A misconfiguration can collapse a six-phase model into two.
EX 3
Reason forwards from one observation
A security analyst notices a workstation making an outbound connection to the same external IP address every 300 seconds, carrying a few kilobytes each time. Nothing else looks wrong. What phase is this, what must already have happened, and what comes next?
1
Read the pattern
Regular, low-volume, outbound traffic at a fixed interval is beaconing — a device checking in for instructions.
2
Name the phase
This is persistence, specifically a command and control channel.
3
Infer backwards
Persistence implies the adversary already achieved initial access — so look for a preceding phishing click or a compromised credential, and expect reconnaissance before that.
4
Infer forwards
The next phases would be lateral movement and then taking action. The small transfer volume so far suggests exfiltration has not yet begun.
5
Act on the timing
Catching an attack at persistence is valuable precisely because the damage phase has not happened yet. Isolate the host and hunt for the initial-access route.
Check yourself
Name the six phases in order.
Show answer
Reconnaissance, initial access, persistence, lateral movement, taking action, and evading detection.
What is OSINT and which phase uses it?
Show answer
Open source intelligence — freely available information such as public web pages, job adverts and social media. It is used in the reconnaissance phase.
What are the two routes to initial access named by the CED?
Show answer
Social engineering, and compromised or weak credentials.
What is a C2 protocol and which phase does it belong to?
Show answer
Command and control — a channel the adversary uses to send commands to the compromised device. It belongs to the persistence phase, letting the adversary keep access without regaining it.
What is the adversary trying to achieve during lateral movement?
Show answer
To escalate privileges by reaching computers and user accounts with elevated permissions to services and data.
Missing log files are evidence of which phase, and why is the absence itself an indicator?
Show answer
Evading detection. Adversaries remove or edit log files and erase planted files such as malware, so an unexplained gap in logging should be treated as a sign of an attack rather than a technical fault.
Does every attack use all six phases?
Show answer
No. The CED states the phases may not all be used in every attack — for example an exposed, unauthenticated database can be looted without persistence or lateral movement.