Fallback Channels T1008

Tactic: Command & Control

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Events covered

3 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 11FileCreate
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 22DNSEvent (DNS query)

Authoring guide

Patterns shared across the 16 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (27 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
Details3contains 2, eq 10x00000001
EventResultDetails_s3eq 2, in 1NXDOMAIN, REFUSED, SERVFAIL
EventTime_t3gt 3min_t
score3ge 35
DnsQueryTypeName2in 2A, AAAA
Image2ends_with 2\outlook.exe
QueryName2contains 2.
TargetFilename2ends_with 2\microsoft\outlook\vbaproject.otm
TargetObject2ends_with 2\outlook\loadmacroprovideronboot, \outlook\security\level
TimeGenerated2gt 2maxSummarizedTime
count_2gt 2200
dcount_sld2gt 2100
DNSQueryCount1gt 1100
DnsResponseCode1eq 1, is_not_null 1NXDOMAIN
DnsResponseCodeName1is_not_null 1

Top indicator values (69 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
EventTime_tgt
min_t
34
scorege
5
36
Detailscontains
0x00000001
24
DnsQueryTypeNamein
A
22
DnsQueryTypeNamein
AAAA
22
EventResultDetails_seq
NXDOMAIN
22
Imageends_with
\outlook.exe
214
QueryNamecontains
.
22
TargetFilenameends_with
\microsoft\outlook\vbaproject.otm
22
TimeGeneratedgt
maxSummarizedTime
24
count_gt
200
25
dcount_sldgt
100
22
DNSQueryCountgt
100
1
Detailseq
0x00000001
163
DnsResponseCodeeq
NXDOMAIN
1
Domaincontains
.
13
Domaincontains
hiddenservice.net
1
Domaincontains
onion.cab
1
Domaincontains
onion.casa
1
Domaincontains
onion.city
1
Domaincontains
onion.direct
1
Domaincontains
onion.dog
1
Domaincontains
onion.ink
1
Domaincontains
onion.it
1
Domaincontains
onion.link
1
Domaincontains
onion.lt
1
Domaincontains
onion.lu
1
Domaincontains
onion.nu
1
Domaincontains
onion.pet
1
Domaincontains
onion.plus
1

Exclusions (11 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 4 rules

Splunk 1 rule

Kusto 11 rules