A multistage chain is an intrusion that unfolds in steps, where each action prepares the next one. Instead of dropping one obvious payload, the attacker starts with a lure, then uses the victim’s response to launch scripts, fetch additional tools, discover internal systems, or establish a remote channel. Each stage reduces friction for the next stage and can help the attacker avoid simple detections that look only for a single malicious file or command.
This matters because modern attacks often mix social engineering, legitimate utilities, and post-access activity. A user may be pushed to run PowerShell, which then downloads more code, performs reconnaissance, or opens a tunnel for command and control. Defenders should think in sequences: unusual browser-to-terminal handoffs, chained child processes, suspicious network connections, and internal discovery from a workstation are all signs that an intrusion is progressing stage by stage.