Multi-Stage Channels (T1104) is a command and control technique. MITRE lists Linux, macOS, Windows and ESXi as platforms.
Rather than one tool talking to one server, the attacker uses several stages that are brought in under different conditions or for different jobs. That splits the picture, so a defender who finds one stage may not find the rest.
How attackers use it
MITRE describes the first stage as a remote access tool that calls back to a first-stage server for instructions. That stage may have automated capabilities to collect basic host information, update tools and upload additional files. A second remote access tool can then be delivered, redirecting the host to a second-stage server. The second stage is likely more fully featured and allows interaction with the system through a reverse shell and other remote access features.
The stages are likely hosted separately with no overlapping infrastructure. The loader may also keep backup first-stage callbacks, or fallback channels, in case the first path is discovered and blocked.
How to detect it
MITRE's strategy, Detect Multi-Stage Command and Control Channels, looks for a chain. Its analytics describe:
- An initial process connecting out to a first-stage server and receiving a payload or commands, then spawning or injecting into a second process that opens a new connection to an unrelated destination.
- On Linux, a shell script or binary using curl or wget against a staging domain, writing output to disk or memory, and soon after launching another process that connects to a different address.
- On macOS, a process using NSURLSession or similar APIs to reach a staging domain, followed by a reverse shell or remote access tool connecting to a second server.
- On ESXi, a command line or API call from the hypervisor to an external staging host, followed by a connection to a second external address by a spawned process or scheduled task.
The signal is the hand-off: connection A, a new process, then connection B to a destination that has nothing to do with A. Endpoint logs that link process creation to network connections make this visible.
How to reduce the risk
MITRE lists one mitigation: network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware.
Add egress filtering by server class, so a newly dropped tool cannot simply connect anywhere, and keep process and connection logs long enough to rebuild the chain after the fact.
Quick check
Why host stages on separate infrastructure?
So that finding and blocking one stage does not expose the others. MITRE notes the stages likely share no infrastructure, and backup callbacks may exist.
What is the key detection signal?
A process connects to a first server, spawns another process, and that process connects to an unrelated second destination shortly after.
Sources
- MITRE ATT&CK, Multi-Stage Channels (T1104)
