T1104_multi-stage-channels

T1104 Multi-Stage Channels

High-Level Description

Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.

Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.

The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.

Kill Chain Phase

• Command and Control (TA0011)

Platforms: Linux, macOS, Windows, ESXi

What to Check

• Identify if Multi-Stage Channels technique is applicable to target environment
• Check Linux systems for indicators of Multi-Stage Channels
• Check macOS systems for indicators of Multi-Stage Channels
• Check Windows systems for indicators of Multi-Stage Channels
• Verify mitigations are bypassed or absent (1 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Multi-Stage Channels by examining the target platforms (Linux, macOS, Windows).

2. Assess Existing Defenses: Review whether mitigations for T1104 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.

Remediation Guide

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Detection

Detect Multi-Stage Command and Control Channels

Risk Assessment

CWE Categories

References

• Atomic Red Team - T1104
• MITRE ATT&CK - T1104