T1104No distinct observable

Multi-Stage Channels

Command and ControlLinux, macOS, Windows, ESXi

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

All three of the brief's analytics (AN0637 Windows, AN0638 Linux, AN0639 macOS) define the observable as a temporal correlation across two separate outbound connections from two different processes to two unrelated destinations — exactly the join lib/sigma cannot express (no 'near', no timeframe, no cross-event correlation per hard rule 4). Reducing to a single leg does not salvage a rule: one process making one outbound connection, or one curl/wget download, is not itself specific to multi-stage C2 — it is the same generic network_connection/process_creation event that any single-stage callback, ingress tool transfer, or ordinary HTTP client produces. A rule keyed on that leg alone would not detect 'multi-stage', it would silently duplicate whatever plain C2-callback detection eventually gets written for T1071.x, while claiming a title this brief does not support. […]

Covered instead by T1071.001, T1071.004, T1008.

What the technique is

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult. Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features. The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.

Read it on attack.mitre.org

What MITRE says you would watch

AN0637
Initial process initiates outbound connection to first-stage C2, receives payloads or commands, then spawns or injects into a second process that establishes a new outbound connection to an unrelated destination (second-stage C2).
AN0638
Shell script or binary initiates curl/wget request to staging domain, writes output to disk or memory, and shortly afterward launches another process that establishes new outbound connection to a different IP or hostname.
AN0639
Initial process using NSURLSession or similar APIs reaches out to known staging domains, followed by creation of a reverse shell or RAT connecting to a second unrelated server.