Fallback Channels T1008

Tactic: Command & Control

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Events covered

4 catalog events are tagged with this technique by at least one rule.

Authoring guide

These 17 rules share fields, values, and exclusions.

Fields filtered most (31 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
Details3contains 2, eq 10x00000001
EventResultDetails_s3eq 2, in 1NXDOMAIN, REFUSED, SERVFAIL
EventTime_t3cross_field_compare 3min_t
score3ge 35
DnsQueryTypeName2in 2A, AAAA
Image2ends_with 2\outlook.exe
QueryName2contains 2.
TargetFilename2ends_with 2\microsoft\outlook\vbaproject.otm
TargetObject2ends_with 2\outlook\loadmacroprovideronboot, \outlook\security\level
TimeGenerated2cross_field_compare 2maxSummarizedTime
count_2gt 2200
dcount_sld2gt 2100
process_name2contains 1, eq 1osascript, squid
DNSQueryCount1gt 1100
DnsResponseCode1eq 1, is_not_null 1nxdomain

Top indicator values (76 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
EventTime_tcross_field_compare
min_t
34
scorege
5
36
Detailscontains
0x00000001
24
DnsQueryTypeNamein
A
22
DnsQueryTypeNamein
AAAA
22
EventResultDetails_seq
NXDOMAIN
22
Imageends_with
\outlook.exe
213
QueryNamecontains
.
27
TargetFilenameends_with
\microsoft\outlook\vbaproject.otm
22
TimeGeneratedcross_field_compare
maxSummarizedTime
24
count_gt
200
25
dcount_sldgt
100
22
DNSQueryCountgt
100
1
Detailseq
0x00000001
161
DnsResponseCodeeq
nxdomain
1
Domaincontains
.
13
Domaincontains
hiddenservice.net
1
Domaincontains
onion.cab
1
Domaincontains
onion.casa
1
Domaincontains
onion.city
1
Domaincontains
onion.direct
1
Domaincontains
onion.dog
1
Domaincontains
onion.ink
1
Domaincontains
onion.it
1
Domaincontains
onion.link
1
Domaincontains
onion.lt
1
Domaincontains
onion.lu
1
Domaincontains
onion.nu
1
Domaincontains
onion.pet
1
Domaincontains
onion.plus
1

Exclusions (11 distinct)

These values appear most often in top-level exclusions.

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 4 rules

Elastic 1 rule

Splunk 1 rule

Kusto 11 rules