tfMITRE ATT&CK technique

Multi-Stage Channels T1104

Tactic: Command and Control
Platforms: Linux, macOS, Windows, ESXi
Version: 1.1
Created: 31 May 2017
Last modified: 24 October 2025

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware74th pct

Tools & malware74th percentile · 74% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Multi-Stage Channels MITRE reference T1104

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT41G0096 ↗

Used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.1

created 2019-09-231 referenceaka Wicked Panda

MuddyWaterG0069 ↗

Has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.1

created 2018-04-181 referenceaka Earth Vetala

Lazarus GroupG0032 ↗

Has used multi-stage malware components that inject later stages into separate processes.1

created 2017-05-311 referenceaka Labyrinth Chollima

APT3G0022 ↗

An APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.1

created 2017-05-311 referenceaka Gothic Panda

All 4 groups for this technique

Offense vs defense T1104

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Multi-Stage Channels detection strategy DET0228

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detect Multi-Stage Command and Control Channels

Enterprise

4 platforms

AN0637 · Windows

Initial process initiates outbound connection to first-stage C2, receives payloads or commands, then spawns or injects into a second process that establishes a new outbound connection to an unrelated destination (second-stage C2).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Correlate two-stage behavior occurring within a short window (e.g., 1-5 minutes)
ParentProcess	Tune to exclude known legitimate updaters and management agents
DestinationHostname	May be customized to exclude known corporate domains and CDNs

AN0638 · Linux

Shell script or binary initiates curl/wget request to staging domain, writes output to disk or memory, and shortly afterward launches another process that establishes new outbound connection to a different IP or hostname.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve, connect
Network Traffic FlowDC0078	iptables:LOG	OUTBOUND

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BinaryPath	Tune for suspicious binaries like curl, wget, python, netcat
IPDistance	Detect multiple different external IPs contacted within short timeframe

AN0639 · macOS

Initial process using NSURLSession or similar APIs reaches out to known staging domains, followed by creation of a reverse shell or RAT connecting to a second unrelated server.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:endpointsecurity	ES_EVENT_TYPE_NOTIFY_EXEC
Network Traffic FlowDC0078	macos:unifiedlog	tcp/udp

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Detect activity outside normal user behavior (e.g., automation or daemon context)
EntropyScore	Optional for detecting encoded payloads delivered via stage 1

AN0640 · ESXi

CLI-based or API-based network call from the hypervisor to external staging host, shortly followed by a connection to a second external IP by a spawned process or scheduled task.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	esxi:cron	process or cron activity
Network Traffic FlowDC0078	esxi:hostd	CLI network calls

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ScheduledTaskName	Detect unknown or obfuscated task names launching follow-up stages
DestinationIP	Scope multiple IP destinations outside corporate ranges in short sequence

Multi-Stage Channels detections T1104

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs