Techniques › T1008

T1008 Fallback Channels

command and control — ESXi, Linux, macOS, Windows · attack.mitre.org · JSON

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

• DET0499 Behavioral Detection of Fallback or Alternate C2 Channels v1.0
  AN1376 Windows

  Establishing network connections on uncommon ports or protocols following C2 disruption or blocking. Often executed by processes that typically exhibit no network activity.

  WinEventLog:Sysmon EventCode=3, 22 → DC0082 Network Connection Creation

  NSM:Flow uncommon ports → DC0078 Network Traffic Flow

  Tunable: DestinationPort ProcessName DataVolumeRatio TimeWindow
  AN1377 Linux

  Creation of outbound connections on alternate ports or using covert transport (e.g., ICMP, DNS) from non-network-intensive processes, following known disruption or blocked traffic.

  auditd:SYSCALL outbound connections → DC0082 Network Connection Creation

  NSM:Flow alternate ports → DC0078 Network Traffic Flow

  Tunable: ProtocolType UserContext
  AN1378 macOS

  Outbound fallback traffic from low-profile or background launch agents using unusual protocols or destinations after primary channel inactivity.

  macos:unifiedlog None → DC0082 Network Connection Creation

  NSM:Flow None → DC0078 Network Traffic Flow

  Tunable: LaunchAgentContext PayloadEntropy
  AN1379 ESXi

  Outbound traffic from host management services or guest-to-host interactions over unusual interfaces (e.g., backdoor API endpoints or external VPN tunnels).

  esxi:vmkernel None → DC0082 Network Connection Creation

  esxi:vpxd None → DC0078 Network Traffic Flow

  Tunable: InterfaceName FallbackIPRanges

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1008