T1008 — Fallback Channels

Tactic: Command and Control · Platforms: ESXi, Linux, macOS, Windows

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Sigma detection rules (4)

title: T1008 Fallback Channels
id: 8a0fa0b2-ece3-401b-bd5d-48121ad25882
description: 'Detects individual outbound network connections (Sysmon EventID 3) per process. Fallback/alternate C2 channel use is a behavioral pattern -- the same process switching across multiple distinct destination ports/addresses within a short window -- which cannot be expressed as a single static field match; see the companion correlation rule below (value_count of DestinationPort per Image within a 10-minute window, threshold >= 3), which implements the actual channel-switching detection. Retargeted from a bare EventID 3/22 match with no channel-switching correlation at all. Tune using: DestinationPort, ProcessName, DataVolumeRatio, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1008
author: Shahrukh Khan
date: 2026-06-22
license: MIT
tags:
  - attack.command-and-control
  - attack.t1008

logsource:
  category: network_connection
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '3'
    Initiated: 'true'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - This base rule alone is high-volume by design (every outbound connection); it only becomes a meaningful fallback-channel detection when combined with the companion correlation rule's multi-destination threshold. System and service accounts are excluded via filter_system_account.

level: medium
---
title: T1008 Fallback Channels - Multi-Destination Correlation
id: 1c2e5f3a-6b9d-4e02-9a71-3d8f0c6b2e41
status: experimental
correlation:
  type: value_count
  rules:
    - 8a0fa0b2-ece3-401b-bd5d-48121ad25882
  group-by:
    - Image
  timespan: 10m
  condition:
    field: DestinationPort
    gte: 3
level: medium

title: T1008 Fallback Channels
id: b16a37ef-3060-4582-9e1e-6d66464b4e7f
description: 'Behavioral Detection of Fallback or Alternate C2 Channels. A single connect() by nc/ncat/socat only shows generic network-tool usage; fallback-channel behavior is inherently a sequence (primary channel failure followed by a secondary channel), which cannot be established from one isolated syscall event. This base rule supplies connect() telemetry for these common C2-capable utilities; the paired correlation rule below counts distinct destination addresses contacted by the same process within a 10-minute window, approximating a primary-then-fallback channel switch. Tune using: ProtocolType, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1008
author: Shahrukh Khan
date: 2026-01-05
license: MIT
tags:
  - attack.command-and-control
  - attack.t1008

logsource:
  category: network_connection
  product: linux

detection:
  selection:
    type: SYSCALL
    syscall: connect
    exe|endswith:
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection

falsepositives:
  - This only flags generic use of common C2-capable network utilities; confirming a genuine primary-to-fallback channel switch requires the paired correlation rule and still benefits from destination-reputation review.

level: low
---
title: T1008 Fallback Channels - Multiple Distinct Destinations from Same Process
id: 7a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d
description: 'Correlation companion for b16a37ef-3060-4582-9e1e-6d66464b4e7f: counts distinct destination addresses contacted by the same network-utility process within a 10-minute window, approximating a fallback/alternate-channel switch that a single connect() event cannot establish.'
status: experimental
correlation:
  type: value_count
  rules:
    - b16a37ef-3060-4582-9e1e-6d66464b4e7f
  group-by:
    - exe
    - pid
  timespan: 10m
  condition:
    field: saddr
    gte: 2

level: medium

title: T1008 Fallback Channels
id: f42336bc-773b-43aa-b19f-8a9b895ca688
description: 'Behavioral Detection of Fallback or Alternate C2 Channels. (Retargeted to the network_connection macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: LaunchAgentContext, PayloadEntropy.'
references:
  - https://attack.mitre.org/techniques/T1008
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.command-and-control
  - attack.t1008

logsource:
  category: network_connection
  product: macos

detection:
  selection:
    Image|contains: '/Library/LaunchAgents/'
  selection_ports:
    DestinationPort:
      - 80
      - 443
      - 8080
      - 8443
  condition: selection and selection_ports

falsepositives:
  - Legitimate LaunchAgent-based helper applications that reconnect to cloud services over multiple ports, since retry-pattern payload entropy cannot be measured from unified log network fields.

level: medium

title: T1008 Fallback Channels
id: f446cc0e-7572-42cc-8ad9-4cc6e5c98630
description: 'Behavioral Detection of Fallback or Alternate C2 Channels. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: InterfaceName, FallbackIPRanges.'
references:
  - https://attack.mitre.org/techniques/T1008
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.command-and-control
  - attack.t1008

logsource:
  product: esxi
  service: hostd

detection:
  selection:
    Message|contains: 'Firewall'
  selection_multi:
    Message|contains|all:
      - 'ruleset'
      - 'allowedIp'

  condition: selection and selection_multi

falsepositives:
  - ESXi has no built-in visibility into fallback command and control channel switching at the network layer; this only proxies via firewall ruleset allow-list edits, which legitimate network hardening changes also produce.

level: low

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1008 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan