{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1104","id":"T1104","name":"Multi-Stage Channels","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1104","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"55b62810a075a105e57ed73292b1be42bdd134397208b30a855f7527d9d8d9c7","description":"Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions. Use of multiple stages may obfuscate the command and control channel to make detection more difficult.\n\nRemote access tools will call back to the first-stage command and control server for instructions. The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files. A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server. The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.\n\nThe different stages will likely be hosted separately with no overlapping infrastructure. The loader may also have backup first-stage callbacks or [Fallback Channels](https://attack.mitre.org/techniques/T1008) in case the original first-stage communication path is discovered and blocked.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1104","external_id":"T1104"}],"platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1104","id":"T1104","name":"Multi-Stage Channels","domain":"enterprise","platforms":["Linux","macOS","Windows","ESXi"],"environments":["cloud-hosted-endpoint","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1104","technique_page":"techniques/enterprise/T1104/","page":"detections/enterprise/T1104/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0228","name":"Detect Multi-Stage Command and Control Channels","url":"https://attack.mitre.org/detectionstrategies/DET0228","stix_id":"x-mitre-detection-strategy--6368178a-04c5-490b-96d5-f12dcccd0497","relationship_id":"relationship--4bb22cca-ded9-422e-8df8-fb1e387c8448","description":"","analytics":[{"id":"AN0637","name":"Analytic 0637","guidance":"Initial process initiates outbound connection to first-stage C2, receives payloads or commands, then spawns or injects into a second process that establishes a new outbound connection to an unrelated destination (second-stage C2).","url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0637","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlate two-stage behavior occurring within a short window (e.g., 1-5 minutes)"},{"field":"ParentProcess","description":"Tune to exclude known legitimate updaters and management agents"},{"field":"DestinationHostname","description":"May be customized to exclude known corporate domains and CDNs"}],"log_sources":[{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","platforms":["Windows"],"analytic_id":"AN0637","source_url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0637","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0637","source_url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0637","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0638","name":"Analytic 0638","guidance":"Shell script or binary initiates curl/wget request to staging domain, writes output to disk or memory, and shortly afterward launches another process that establishes new outbound connection to a different IP or hostname.","url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0638","platforms":["Linux"],"tuning":[{"field":"BinaryPath","description":"Tune for suspicious binaries like curl, wget, python, netcat"},{"field":"IPDistance","description":"Detect multiple different external IPs contacted within short timeframe"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve, connect","platforms":["Linux"],"analytic_id":"AN0638","source_url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0638","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"iptables:LOG","channel":"OUTBOUND","platforms":["Linux"],"analytic_id":"AN0638","source_url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0638","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0639","name":"Analytic 0639","guidance":"Initial process using NSURLSession or similar APIs reaches out to known staging domains, followed by creation of a reverse shell or RAT connecting to a second unrelated server.","url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0639","platforms":["macOS"],"tuning":[{"field":"UserContext","description":"Detect activity outside normal user behavior (e.g., automation or daemon context)"},{"field":"EntropyScore","description":"Optional for detecting encoded payloads delivered via stage 1"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:endpointsecurity","channel":"ES_EVENT_TYPE_NOTIFY_EXEC","platforms":["macOS"],"analytic_id":"AN0639","source_url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0639","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0078","component":"Network Traffic Flow","name":"macos:unifiedlog","channel":"tcp/udp","platforms":["macOS"],"analytic_id":"AN0639","source_url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0639","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN0640","name":"Analytic 0640","guidance":"CLI-based or API-based network call from the hypervisor to external staging host, shortly followed by a connection to a second external IP by a spawned process or scheduled task.","url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0640","platforms":["ESXi"],"tuning":[{"field":"ScheduledTaskName","description":"Detect unknown or obfuscated task names launching follow-up stages"},{"field":"DestinationIP","description":"Scope multiple IP destinations outside corporate ranges in short sequence"}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"esxi:hostd","channel":"CLI network calls","platforms":["ESXi"],"analytic_id":"AN0640","source_url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0640","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0032","component":"Process Creation","name":"esxi:cron","channel":"process or cron activity","platforms":["ESXi"],"analytic_id":"AN0640","source_url":"https://attack.mitre.org/detectionstrategies/DET0228#AN0640","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"Individual [Uroburos](https://attack.mitre.org/software/S0022) implants can use multiple communication channels based on one of four available modes of operation.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--a2006705-7f1b-4081-a074-5313f1d8c7af","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0031","name":"BACKSPACE","url":"https://attack.mitre.org/software/S0031","kind":"malware","description":"[BACKSPACE](https://attack.mitre.org/software/S0031) attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs \"louder\" interactions with the malware.(Citation: FireEye APT30)","relationship_id":"relationship--a6962782-1942-42f5-a627-f205376e2ec2","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0069","name":"BLACKCOFFEE","url":"https://attack.mitre.org/software/S0069","kind":"malware","description":"[BLACKCOFFEE](https://attack.mitre.org/software/S0069) uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.(Citation: FireEye APT17)","relationship_id":"relationship--25ad5783-c7fe-4715-b4ce-c03b36ccdfa8","references":[{"source_name":"FireEye APT17","description":"FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"}]},{"id":"S0220","name":"Chaos","url":"https://attack.mitre.org/software/S0220","kind":"malware","description":"After initial compromise, [Chaos](https://attack.mitre.org/software/S0220) will download a second stage to establish a more permanent presence on the affected system.(Citation: Chaos Stolen Backdoor)","relationship_id":"relationship--d4f7fac4-ddc0-40fa-8b16-c61b1de30072","references":[{"source_name":"Chaos Stolen Backdoor","description":"Sebastian Feldmann. (2018, February 14). Chaos: a Stolen Backdoor Rising Again. Retrieved March 5, 2018.","url":"http://gosecure.net/2018/02/14/chaos-stolen-backdoor-rising/"}]},{"id":"S0476","name":"Valak","url":"https://attack.mitre.org/software/S0476","kind":"malware","description":"[Valak](https://attack.mitre.org/software/S0476) can download additional modules and malware capable of using separate C2 channels.(Citation: Unit 42 Valak July 2020)","relationship_id":"relationship--48e3f4e2-0506-4b5c-b40c-2c6edc92b0a5","references":[{"source_name":"Unit 42 Valak July 2020","description":"Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.","url":"https://unit42.paloaltonetworks.com/valak-evolution/"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"The [Bazar](https://attack.mitre.org/software/S0534) loader is used to download and execute the [Bazar](https://attack.mitre.org/software/S0534) backdoor.(Citation: Cybereason Bazar July 2020)(Citation: Zscaler Bazar September 2020)","relationship_id":"relationship--711879b6-a9ac-42c6-a6a0-244b03890cec","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"Zscaler Bazar September 2020","description":"Sadique, M. and Singh, A. (2020, September 29). Spear Phishing Campaign Delivers Buer and Bazar Malware. Retrieved November 19, 2020.","url":"https://www.zscaler.com/blogs/research/spear-phishing-campaign-delivers-buer-and-bazar-malware"}]},{"id":"S1086","name":"Snip3","url":"https://attack.mitre.org/software/S1086","kind":"malware","description":"[Snip3](https://attack.mitre.org/software/S1086) can download and execute additional payloads and modules over separate communication channels.(Citation: Morphisec Snip3 May 2021)(Citation: Telefonica Snip3 December 2021)","relationship_id":"relationship--8f060861-0206-4dcc-9f46-c55bde63ae40","references":[{"source_name":"Telefonica Snip3 December 2021","description":"Jornet, A. (2021, December 23). Snip3, an investigation into malware. Retrieved September 19, 2023.","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"},{"source_name":"Morphisec Snip3 May 2021","description":"Lorber, N. (2021, May 7). Revealing the Snip3 Crypter, a Highly Evasive RAT Loader. Retrieved September 13, 2023.","url":"https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) can use one C2 URL for first contact and to upload information about the host computer and two additional C2 URLs for getting commands.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--23577031-f987-40c5-95ea-65689f9f39fc","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"\n[Latrodectus](https://attack.mitre.org/software/S1160) has used a two-tiered C2 configuration with tier one nodes connecting to the victim and tier two nodes connecting to backend infrastructure.(Citation: Latrodectus APR 2024)","relationship_id":"relationship--a05c9888-4d88-4487-8e48-b0509de3fb50","references":[{"source_name":"Latrodectus APR 2024","description":"Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"id":"S1206","name":"JumbledPath","url":"https://attack.mitre.org/software/S1206","kind":"malware","description":"[JumbledPath](https://attack.mitre.org/software/S1206) can communicate over a unique series of connections to send and retrieve data from exploited devices.(Citation: Cisco Salt Typhoon FEB 2025)","relationship_id":"relationship--6114128d-66e6-4b94-9593-220f9e326cef","references":[{"source_name":"Cisco Salt Typhoon FEB 2025","description":"Cisco Talos. (2025, February 20). Weathering the storm: In the midst of a Typhoon. Retrieved February 24, 2025.","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]}],"actors":[{"id":"G0022","name":"APT3","url":"https://attack.mitre.org/groups/G0022","kind":"intrusion-set","description":"An [APT3](https://attack.mitre.org/groups/G0022) downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.(Citation: FireEye Operation Double Tap)","relationship_id":"relationship--1258536b-6cf4-4cfe-98c7-e9c1d30c5a34","references":[{"source_name":"FireEye Operation Double Tap","description":"Moran, N., et al. (2014, November 21). Operation Double Tap. Retrieved January 14, 2016.","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has used multi-stage malware components that inject later stages into separate processes.(Citation: Lazarus APT January 2022)","relationship_id":"relationship--3cf183ef-05aa-47ad-b691-654c0648326a","references":[{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.(Citation: Talos MuddyWater May 2019) ","relationship_id":"relationship--a3a7d091-49bb-4fd1-9442-d02e83a48ea1","references":[{"source_name":"Talos MuddyWater May 2019","description":"Adamitis, D. et al. (2019, May 20). Recent MuddyWater-associated BlackWater campaign shows signs of new anti-detection techniques. Retrieved June 5, 2019.","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.(Citation: FireEye APT41 March 2020)","relationship_id":"relationship--f234930f-f7d1-458d-8c79-c73538990f97","references":[{"source_name":"FireEye APT41 March 2020","description":"Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]}],"mitigations":[{"id":"M1031","name":"Network Intrusion Prevention","url":"https://attack.mitre.org/mitigations/M1031","kind":"course-of-action","description":"Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.","relationship_id":"relationship--3a348ba8-5608-4e9b-a180-f66cfad9896e","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1008":"/ttp-simulation/techniques/enterprise/T1008/","T1104":"/ttp-simulation/techniques/enterprise/T1104/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1104","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}