tfMITRE ATT&CK technique

Fallback Channels T1008

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 31 May 2017
Last modified: 12 May 2026

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 70% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have fewer tools implementing them.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Fallback Channels T1008

Tactic: Command and Control
Platforms: ESXi, Linux, macOS, Windows
Version: 1.1
Created: 31 May 2017
Last modified: 12 May 2026

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups73rd pct

Threat groups73rd percentile · 70% of ATT&CK techniques have fewer threat groups attributed.

Campaigns72nd pct

Campaigns72nd percentile · 54% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 7%

Tools & malware93rd percentile · 93% of ATT&CK techniques have fewer tools implementing them.

Detection rules64th pct

Detection rules64th percentile · 60% of ATT&CK techniques have fewer detection rules written.

Fallback Channels MITRE reference T1008

73rd pctamong all ATT&CK techniques for number of groups

5 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has employed layers of redundancy to maintain access to compromised environments including network devices, hypervisors, and virtual machines.1

created 2025-05-291 reference

APT41G0096 ↗

Used the Steam community page as a fallback mechanism for C2.1

created 2019-09-231 referenceaka Wicked Panda

OilRigG0049 ↗

Malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.1

created 2017-12-141 referenceaka COBALT GYPSY

FIN7G0046 ↗

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.1

created 2017-05-311 referenceaka GOLD NIAGARA

Lazarus GroupG0032 ↗

Malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.1 2

created 2017-05-312 referencesaka Labyrinth Chollima

All 5 groups for this technique

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	uncommon ports
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22

Data component

Name

Channel

Network Traffic FlowDC0078

NSM:Flow

uncommon ports

Network Connection CreationDC0082

WinEventLog:Sysmon

EventCode=3, 22

Field	What you tune
DestinationPort	Can be tuned to include unexpected or high-entropy ports not typically associated with the process.
ProcessName	Useful to filter benign applications vs suspicious fallback attempts.
DataVolumeRatio	Tunable ratio of sent/received bytes to indicate potential C2 beaconing or exfiltration.
TimeWindow	Adjust temporal window to match likely fallback C2 retries after primary channel fails.

Field

What you tune

DestinationPort

Can be tuned to include unexpected or high-entropy ports not typically associated with the process.

ProcessName

Useful to filter benign applications vs suspicious fallback attempts.

DataVolumeRatio

Tunable ratio of sent/received bytes to indicate potential C2 beaconing or exfiltration.

TimeWindow

Adjust temporal window to match likely fallback C2 retries after primary channel fails.

Field	What you tune
ProtocolType	Can filter for rare fallback channel types (e.g., ICMP, DNS over HTTP).
UserContext	Tuning by user (e.g., root vs. service account) helps suppress noise.

Field	What you tune
LaunchAgentContext	Used to suppress known legitimate agents.
PayloadEntropy	Can help isolate covert or encrypted fallback traffic.

Field	What you tune
InterfaceName	May vary based on ESXi build and should be filtered to suppress known interfaces.
FallbackIPRanges	Environment-specific ranges to ignore (e.g., DR tunnels or out-of-band mgmt).

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the creation of a macro file for Outlook.	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	medium	@ScoubiMtl	2021-04-05	2023-02-08	8c31f563-f9a7-450c-bfa8-35f8f32f1f61
	Detects the modification of Outlook security setting to allow unprompted execution of macros.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	@ScoubiMtl	2021-04-05	2023-08-17	e3b50fa5-3c3f-444e-937b-0a99d33731cd
	Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the au (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	Nasreddine Bencherchali (Nextron Systems)	2021-04-05	2023-08-17	396ae3eb-4174-4b9b-880e-dc0364d78a19
	Detects the creation of a macro file for Outlook.	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-08	—	117d3d3a-755c-4a61-b23e-9171146d094c
Splunk	The following analytic detects the modification of the Windows Registry key "Level" under Outlook Security. (...)	Generic	stable	registry_event	windows	Sysmon	Command and Control Fallback Channels Persistence Office Application Startup	-	medium	Raven Tait, Splunk	2020-04-29	2026-05-13	47872bb4-9987-4c33-a897-4d2d1ac7d4c2

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects the creation of a macro file for Outlook.	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	medium	@ScoubiMtl	2021-04-05	2023-02-08	8c31f563-f9a7-450c-bfa8-35f8f32f1f61
	Detects the modification of Outlook security setting to allow unprompted execution of macros.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	@ScoubiMtl	2021-04-05	2023-08-17	e3b50fa5-3c3f-444e-937b-0a99d33731cd
	Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the au (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	Nasreddine Bencherchali (Nextron Systems)	2021-04-05	2023-08-17	396ae3eb-4174-4b9b-880e-dc0364d78a19
	Detects the creation of a macro file for Outlook.	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Event Triggered Execution Command and Control Fallback Channels Persistence Office Application Startup	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-08	—	117d3d3a-755c-4a61-b23e-9171146d094c
Splunk	The following analytic detects the modification of the Windows Registry key "Level" under Outlook Security. (...)	Generic	stable	registry_event	windows	Sysmon	Command and Control Fallback Channels Persistence Office Application Startup	-	medium	Raven Tait, Splunk	2020-04-29	2026-05-13	47872bb4-9987-4c33-a897-4d2d1ac7d4c2

Fallback Channels T1008

Fallback Channels T1008

Fallback Channels MITRE reference T1008

Fallback Channels MITRE reference T1008

Offense vs defense T1008

Fallback Channels detection strategy DET0499

Behavioral Detection of Fallback or Alternate C2 Channels

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Fallback Channels detections T1008

Fallback Channels detections T1008

Data component	Name	Channel
Network Traffic FlowDC0078	NSM:Flow	alternate ports
Network Connection CreationDC0082	auditd:SYSCALL	outbound connections

Data component	Name	Channel
Network Traffic FlowDC0078	esxi:vpxd	—
Network Connection CreationDC0082	esxi:vmkernel	—