tfMITRE ATT&CK technique

Fallback Channels T1008

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 31 May 2017
Last modified: 12 May 2026

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 73% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules64th pct

Detection rules64th percentile · 64% of ATT&CK techniques have this many detection rules written or fewer.

Fallback Channels MITRE reference T1008

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has employed layers of redundancy to maintain access to compromised environments including network devices, hypervisors, and virtual machines.1

created 2025-05-291 reference

APT41G0096 ↗

Used the Steam community page as a fallback mechanism for C2.1

created 2019-09-231 referenceaka Wicked Panda

OilRigG0049 ↗

Malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.1

created 2017-12-141 referenceaka COBALT GYPSY

FIN7G0046 ↗

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.1

created 2017-05-311 referenceaka GOLD NIAGARA

Lazarus GroupG0032 ↗

Malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.1 2

created 2017-05-312 referencesaka Labyrinth Chollima

All 5 groups for this technique

Offense vs defense T1008

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 1

first rule: 2020 Q2 · 0 of 1 campaigns plotted (Night Dragon (dated 2009) falls before the 2017 window)

Fallback Channels detection strategy DET0499

MITRE names one behaviour worth catching for this technique and breaks it into 4 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Fallback or Alternate C2 Channels

Enterprise

4 platforms

AN1376 · Windows

Establishing network connections on uncommon ports or protocols following C2 disruption or blocking. Often executed by processes that typically exhibit no network activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	uncommon ports
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DestinationPort	Can be tuned to include unexpected or high-entropy ports not typically associated with the process.
ProcessName	Useful to filter benign applications vs suspicious fallback attempts.
DataVolumeRatio	Tunable ratio of sent/received bytes to indicate potential C2 beaconing or exfiltration.
TimeWindow	Adjust temporal window to match likely fallback C2 retries after primary channel fails.

AN1377 · Linux

Creation of outbound connections on alternate ports or using covert transport (e.g., ICMP, DNS) from non-network-intensive processes, following known disruption or blocked traffic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	alternate ports
Network Connection CreationDC0082	auditd:SYSCALL	outbound connections

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ProtocolType	Can filter for rare fallback channel types (e.g., ICMP, DNS over HTTP).
UserContext	Tuning by user (e.g., root vs. service account) helps suppress noise.

AN1378 · macOS

Outbound fallback traffic from low-profile or background launch agents using unusual protocols or destinations after primary channel inactivity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	None
Network Connection CreationDC0082	macos:unifiedlog	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
LaunchAgentContext	Used to suppress known legitimate agents.
PayloadEntropy	Can help isolate covert or encrypted fallback traffic.

AN1379 · ESXi

Outbound traffic from host management services or guest-to-host interactions over unusual interfaces (e.g., backdoor API endpoints or external VPN tunnels).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:vpxd	None
Network Connection CreationDC0082	esxi:vmkernel	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InterfaceName	May vary based on ESXi build and should be filtered to suppress known interfaces.
FallbackIPRanges	Environment-specific ranges to ignore (e.g., DR tunnels or out-of-band mgmt).

Fallback Channels detections T1008

5 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

64th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs