Multi-Stage Channels
Technique · ATTACK:enterprise:T1104
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1104",
"title": "Multi-Stage Channels",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1104",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--84e02621-8fdf-470f-bd58-993bb6a89d91",
"external_id": "T1104",
"domain": "enterprise",
"created": "2017-05-31T21:31:15.935Z",
"modified": "2025-10-24T17:49:03.646Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
]
}Explicit source assertions (16)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1258536b-6cf4-4cfe-98c7-e9c1d30c5a34
FireEye Operation Double TapATTACK:enterprise:S1141 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--23577031-f987-40c5-95ea-65689f9f39fc
ESET Turla Lunar toolset May 2024ATTACK:enterprise:S0069 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25ad5783-c7fe-4715-b4ce-c03b36ccdfa8
FireEye APT17ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--338559ba-2fd5-4677-8308-69aed36b5865
Mandiant UNC3886 Juniper Routers MAR 2025ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a348ba8-5608-4e9b-a180-f66cfad9896e
ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3cf183ef-05aa-47ad-b691-654c0648326a
Lazarus APT January 2022ATTACK:enterprise:S0476 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--48e3f4e2-0506-4b5c-b40c-2c6edc92b0a5
Unit 42 Valak July 2020ATTACK:enterprise:S1206 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6114128d-66e6-4b94-9593-220f9e326cef
Cisco Salt Typhoon FEB 2025ATTACK:enterprise:S0534 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--711879b6-a9ac-42c6-a6a0-244b03890cec
Cybereason Bazar July 2020 · Zscaler Bazar September 2020ATTACK:enterprise:S1086 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f060861-0206-4dcc-9f46-c55bde63ae40
Telefonica Snip3 December 2021 · Morphisec Snip3 May 2021ATTACK:enterprise:S1160 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a05c9888-4d88-4487-8e48-b0509de3fb50
Latrodectus APR 2024ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2006705-7f1b-4081-a074-5313f1d8c7af
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a3a7d091-49bb-4fd1-9442-d02e83a48ea1
Talos MuddyWater May 2019ATTACK:enterprise:S0031 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6962782-1942-42f5-a627-f205376e2ec2
FireEye APT30ATTACK:enterprise:S0220 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4f7fac4-ddc0-40fa-8b16-c61b1de30072
Chaos Stolen BackdoorATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1104
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f234930f-f7d1-458d-8c79-c73538990f97
FireEye APT41 March 2020