Multi-Stage Channels
Multi-stage channels use different communication routes for separate parts of an operation.
What it means
Multi-stage channels use different communication routes for separate parts of an operation. The first observed channel may serve only discovery or delivery.
An investigation example
A small initial beacon retrieves configuration, after which a second process establishes a different long-lived connection.
Evidence to examine
Connect process handoffs, retrieved configuration, destination changes, and timing across the stages.
A common analytical pitfall
Treating each destination as an unrelated event can hide the coordinated sequence.
Response considerations
Preserve the transitions and investigate the complete communication chain before concluding that blocking one stage ended access.
Different stages can use different relationships
A multi-stage communication pattern separates parts of an intrusion's coordination across channels or components. An initial contact may provide information or a later component, while another channel handles subsequent interaction. Investigators should therefore follow the sequence beyond the first visible destination. Blocking one address does not establish that every related communication path is gone.
Multiple destinations are also common in legitimate software. Installers, browsers, and update systems contact different services for different functions. Evaluate the originating process, downloaded material, execution relationships, timing, and expected application behavior. The number of connections alone does not distinguish a staged intrusion from an ordinary distributed application.
A fictional download-to-callback sequence
An academy's endpoint records show an unfamiliar process contacting one service, creating a new executable, and launching it. The new process then communicates with another destination. Analysts preserve file identities, process ancestry, and network context to examine whether the sequence is connected. They compare it with approved update activity rather than infer intent solely from the destination change.
A proxy or encrypted channel may obscure content, while endpoint telemetry supplies the process relationship. State which evidence supports each part of the chain. If the second connection is visible only later, do not assume its earlier history without records. The report should distinguish an observed stage transition from a hypothesis about unseen infrastructure.
Trace the handoff
Create fictional events for an initial request, a file creation, a process launch, and a later connection. Identify the evidence needed to connect each handoff. Then write a benign update explanation and a suspicious alternative. Use prepared logs or an authorized lab; there is no need to build a real remote-control chain.
Containment should consider the host, identities, created components, and alternate destinations together. Removing only the first visible indicator may interrupt one stage while leaving another active. Coordinate changes with the incident owner and validate the intended effect through available telemetry.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
MITRE ATT&CK T1104: Multi-Stage Channels