A retailer mailbox has received a weaponized document, and nobody has opened the file. Which Lockheed Kill Chain phase describes this point?
Select an answer to reveal the explanation.
Short Explanation
A sealed package on the doorstep is delivery, even if nobody has opened it yet. You have a weaponized document that reached the retailer by email and has not been opened, so this is delivery. The trap is calling it exploitation, installation, or reconnaissance from another week.
Full Explanation
In the Lockheed Kill Chain, delivery is the step that gets the weaponized artifact to the target. The retailer has the document by email, and nobody has opened it. The payload has arrived and has not run. This point is "Delivery, the point where the weaponized document has reached the retailer by email". Exploitation is the payload running on a host. The file is still unopened, so "Exploitation, the point where the document payload actually runs on a store host" has not happened. Installation is planting the payload so it remains after the initial run. There has been no run and no plant, so "Installation, the point where the payload is planted so it survives reboot on a store host" fails. Reconnaissance from another week was the earlier collection of names and addresses. It is not the arrival of this message, so "Reconnaissance from another week, the point where names and addresses were only collected" fails. Exam caveat: delivery is complete when the weaponized document reaches the mailbox, even though exploitation has not started. Operational check: confirm the message is still unopened, preserve it, and do not record exploitation until a host actually runs the document.