Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1104_multi-stage-channels
Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.
Passed 17 of 22 test cases with the skill, and 12 of 22 without it.
and 3 more in the full report
5 fixed12 passed either way5 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
When building an audit matrix for multi-staged C2 callback architectures, security staff typically include Linux, macOS, and Windows endpoints. Does VMware ESXi belong on this platform list for MITRE ATT&CK technique T1104, or is ESXi out of scope for this technique? Provide the complete supported platform list.
| Checked | Without skill | With skill |
|---|---|---|
| The response explicitly includes ESXi in the supported platform list. | Missed | Passed |
| The response confirms ESXi is in scope for T1104. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.
Remote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.
The different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.
Platforms: Linux, macOS, Windows, ESXi
Identify Attack Surface: Determine if the target environment is susceptible to Multi-Stage Channels by examining the target platforms (Linux, macOS, Windows).
Assess Existing Defenses: Review whether mitigations for T1104 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 12 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.