The third step of the Cyber Kill Chain is the "Delivery" stage. At this stage, the attacker executes the cyber attack that he prepared for in the preceding phases. This is the stage where the first interaction with the victim happens. For instance, malware is uploaded to the proper environment at this step, and the victim downloads the malware from the uploaded environment to their systems. Malicious content can be conveyed to the victims' devices in various ways during the delivery phase. The methods used for delivering malicious content may differ depending on the type of attack. For instance, using email for a phishing attack may be preferred, or the malicious content in the email can be uploaded to a web address.

Adversary

In the "Delivery" stage, the attacker can deliver a variety of cyber weapons to the victim via a variety of methods. At this stage, the attacker can carry out the following operations:

• Delivering a malicious URL via email
• Delivering malware as a file attachment via email
• Delivering malware through the website
• Delivering the malicious URL via social media
• Delivering malware via social media
• Uploading the malware directly to the target server (if direct access to the server is possible)
• Physically installing or enabling the installation of malware directly to the target system via a USB device

Defender

Blue teams and individual users can take plenty of precautionary measures at this stage. Although they cannot totally prevent the cyber attack from occurring, these precautions can drastically minimize the risk of a successful cyber attack. Some of these measures are listed below:

• Adopting a skeptical attitude towards URLs in email content and viewing them in a sandbox environment
• Scanning the email's attachments using antivirus software
• Using email security solution products in organizations
• Ensuring that users/institutional employees receive training on information security
• Constant monitoring of server access and recording of logs
• Effective use and management of security solutions such as Firewall
• Conducting detailed analysis of suspicious activities when needed