AN0637
Analytic 0637
Windows
Initial process initiates outbound connection to first-stage C2, receives payloads or commands, then spawns or injects into a second process that establishes a new outbound connection to an unrelated destination (second-stage C2).
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:Sysmon
EventCode=1
[TimeWindow]
Correlate two-stage behavior occurring within a short window (e.g., 1-5 minutes)
[ParentProcess]
Tune to exclude known legitimate updaters and management agents
[DestinationHostname]
May be customized to exclude known corporate domains and CDNs
AN0638
Analytic 0638
Linux
Shell script or binary initiates curl/wget request to staging domain, writes output to disk or memory, and shortly afterward launches another process that establishes new outbound connection to a different IP or hostname.
auditd:SYSCALL
execve, connect
iptables:LOG
OUTBOUND
[BinaryPath]
Tune for suspicious binaries like curl, wget, python, netcat
[IPDistance]
Detect multiple different external IPs contacted within short timeframe
AN0639
Analytic 0639
macOS
Initial process using NSURLSession or similar APIs reaches out to known staging domains, followed by creation of a reverse shell or RAT connecting to a second unrelated server.
macos:endpointsecurity
ES_EVENT_TYPE_NOTIFY_EXEC
macos:unifiedlog
tcp/udp
[UserContext]
Detect activity outside normal user behavior (e.g., automation or daemon context)
[EntropyScore]
Optional for detecting encoded payloads delivered via stage 1
AN0640
Analytic 0640
ESXi
CLI-based or API-based network call from the hypervisor to external staging host, shortly followed by a connection to a second external IP by a spawned process or scheduled task.
esxi:hostd
CLI network calls
esxi:cron
process or cron activity
[ScheduledTaskName]
Detect unknown or obfuscated task names launching follow-up stages
[DestinationIP]
Scope multiple IP destinations outside corporate ranges in short sequence