T1104 — Multi-Stage Channels

Tactic: Command and Control · Platforms: Linux, macOS, Windows, ESXi

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult. Remote access tools will call back to the first-stage command…

Sigma detection rules (4)

T1104 Multi-Stage Channels

title: T1104 Multi-Stage Channels
id: fcc71f98-8669-4ef3-ade4-a92608ede004
description: 'Detects LOLBins initiating outbound connections, single-event proxy for multi-stage loaders (pair with correlation for full fidelity). (Data Component: Network Connection Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, ParentProcess, DestinationHostname.'
references:
  - https://attack.mitre.org/techniques/T1104
author: Shahrukh Khan
date: 2026-01-31
license: MIT
tags:
  - attack.command-and-control
  - attack.t1104

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection_lolbin_network:
    Image|endswith:
      - '\rundll32.exe'
      - '\mshta.exe'
      - '\regsvr32.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
    Initiated: 'true'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: selection_lolbin_network and not filter_system_account

falsepositives:
  - Legitimate scripting/installer network activity.

level: medium

T1104 Multi-Stage Channels

title: T1104 Multi-Stage Channels
id: 36ef8fbe-f7be-449e-bf7d-ff8198a92300
description: 'Multi-Stage Channels involves malware dynamically switching between first- and second-stage C2 infrastructure. The prior rule flagged any non-script binary executing from /tmp, /var/tmp, or /dev/shm - a generic "suspicious execution location" heuristic shared by dozens of unrelated techniques, with no connection to staged C2 switching. Retargeted to genuine multi-stage evidence: a process launched from a transient/writable path making outbound connections to multiple distinct remote addresses in a short window, observable via auditd connect() syscall auditing (type=SOCKADDR) when an audit rule watches the connect syscall. This detection rule supplies the base telemetry; the paired correlation rule below counts distinct destination addresses per process within a 10-minute window to surface the actual staged-switching pattern. Tune using: BinaryPath, IPDistance.'
references:
  - https://attack.mitre.org/techniques/T1104
author: Shahrukh Khan
date: 2026-06-05
license: MIT
tags:
  - attack.command-and-control
  - attack.t1104

logsource:
  category: network_connection
  product: linux
  service: auditd

detection:
  selection:
    type: SOCKADDR
  selection_transient_path:
    exe|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'

  condition: selection and selection_transient_path

falsepositives:
  - Legitimate installers, CI runners, and short-lived containers execute from /tmp and make normal outbound calls; IP-distance-based staging inference is not available from auditd alone, so pair this with the companion correlation rule and review destination reputation before acting.

level: medium
---
title: T1104 Multi-Stage Channels - Multiple Distinct Remote Addresses from Transient-Path Process
id: 8f3d2c1a-9b4e-4a7f-8c2d-1e5f6a7b8c9d
description: 'Correlation companion for 36ef8fbe-f7be-449e-bf7d-ff8198a92300: counts distinct destination addresses (SOCKADDR saddr) contacted by the same transient-path process within a 10-minute window, approximating the staged/first-stage-then-second-stage C2 switching behavior described by this technique.'
status: experimental
correlation:
  type: value_count
  rules:
    - 36ef8fbe-f7be-449e-bf7d-ff8198a92300
  group-by:
    - exe
    - pid
  timespan: 10m
  condition:
    field: saddr
    gte: 2

level: medium

T1104 Multi-Stage Channels

title: T1104 Multi-Stage Channels
id: ea727ad2-1b0d-4c48-85f4-59efefeb32f4
description: 'Detect Multi-Stage Command and Control Channels. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UserContext, EntropyScore.'
references:
  - https://attack.mitre.org/techniques/T1104
author: Shahrukh Khan
date: 2026-05-06
license: MIT
tags:
  - attack.command-and-control
  - attack.t1104

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    CommandLine|contains|all:
      - 'curl'
      - '| bash'

  condition: selection

falsepositives:
  - Some legitimate install scripts, such as Homebrew, use the curl-pipe-to-shell pattern.

level: high

T1104 Multi-Stage Channels

title: T1104 Multi-Stage Channels
id: ffba065a-d9b7-4ab4-bfab-7f476e263fcd
description: 'Detect Multi-Stage Command and Control Channels. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ScheduledTaskName, DestinationIP.'
references:
  - https://attack.mitre.org/techniques/T1104
author: Shahrukh Khan
date: 2026-01-19
license: MIT
tags:
  - attack.command-and-control
  - attack.t1104

logsource:
  category: process_creation
  product: esxi
  service: shell

detection:
  selection_stage1:
    CommandLine|contains:
      - 'wget '
      - 'curl '
  selection_stage2:
    CommandLine|contains|all:
      - 'chmod'
      - '+x'

  condition: selection_stage1 and selection_stage2

falsepositives:
  - Routine patch or agent installation workflows that download a script or binary and then mark it executable; ESXi Shell logging cannot establish ordering or causality between the two commands, only that both occurred in the same session.

level: medium

Explore