{"id":"T1008","name":"Fallback Channels","url":"https://attack.mitre.org/techniques/T1008","tactics":["command-and-control"],"platforms":["ESXi","Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0499","stix_id":"x-mitre-detection-strategy--ee1c44c9-c5aa-4a9c-9e68-49854ed4d602","name":"Behavioral Detection of Fallback or Alternate C2 Channels","url":"https://attack.mitre.org/detectionstrategies/DET0499","analytics":[{"id":"AN1376","stix_id":"x-mitre-analytic--fcb2ed1a-2f39-47e8-9524-95ceac0ff383","name":"Analytic 1376","description":"Establishing network connections on uncommon ports or protocols following C2 disruption or blocking. Often executed by processes that typically exhibit no network activity.","url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1376","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"NSM:Flow","channel":"uncommon ports","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"DestinationPort","description":"Can be tuned to include unexpected or high-entropy ports not typically associated with the process."},{"field":"ProcessName","description":"Useful to filter benign applications vs suspicious fallback attempts."},{"field":"DataVolumeRatio","description":"Tunable ratio of sent/received bytes to indicate potential C2 beaconing or exfiltration."},{"field":"TimeWindow","description":"Adjust temporal window to match likely fallback C2 retries after primary channel fails."}],"live":true,"detection_strategies":["DET0499"],"techniques":["T1008"]},{"id":"AN1377","stix_id":"x-mitre-analytic--a50c90f1-51b1-4948-8945-4b89735d4750","name":"Analytic 1377","description":"Creation of outbound connections on alternate ports or using covert transport (e.g., ICMP, DNS) from non-network-intensive processes, following known disruption or blocked traffic.","url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1377","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"outbound connections","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Flow","channel":"alternate ports","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"ProtocolType","description":"Can filter for rare fallback channel types (e.g., ICMP, DNS over HTTP)."},{"field":"UserContext","description":"Tuning by user (e.g., root vs. service account) helps suppress noise."}],"live":true,"detection_strategies":["DET0499"],"techniques":["T1008"]},{"id":"AN1378","stix_id":"x-mitre-analytic--3e682b33-5064-4202-aad7-ca1900fde1a5","name":"Analytic 1378","description":"Outbound fallback traffic from low-profile or background launch agents using unusual protocols or destinations after primary channel inactivity.","url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1378","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"None","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-unifiedlog"},{"name":"NSM:Flow","channel":"None","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"nsm-flow"}],"mutable_elements":[{"field":"LaunchAgentContext","description":"Used to suppress known legitimate agents."},{"field":"PayloadEntropy","description":"Can help isolate covert or encrypted fallback traffic."}],"live":true,"detection_strategies":["DET0499"],"techniques":["T1008"]},{"id":"AN1379","stix_id":"x-mitre-analytic--5e7eea18-14f5-4d76-b5cc-bc63a0e5ce65","name":"Analytic 1379","description":"Outbound traffic from host management services or guest-to-host interactions over unusual interfaces (e.g., backdoor API endpoints or external VPN tunnels).","url":"https://attack.mitre.org/detectionstrategies/DET0499#AN1379","platforms":["ESXi"],"log_source_references":[{"name":"esxi:vmkernel","channel":"None","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"esxi-vmkernel"},{"name":"esxi:vpxd","channel":"None","data_component":"DC0078","data_component_name":"Network Traffic Flow","log_source_slug":"esxi-vpxd"}],"mutable_elements":[{"field":"InterfaceName","description":"May vary based on ESXi build and should be filtered to suppress known interfaces."},{"field":"FallbackIPRanges","description":"Environment-specific ranges to ignore (e.g., DR tunnels or out-of-band mgmt)."}],"live":true,"detection_strategies":["DET0499"],"techniques":["T1008"]}],"live":true,"version":"1.0","techniques":["T1008"]}],"sigma_rules":[{"id":"117d3d3a-755c-4a61-b23e-9171146d094c","title":"Suspicious Outlook Macro Created","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-08","modified":null,"description":"Detects the creation of a macro file for Outlook.","references":["https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53","https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.command-and-control","attack.t1137","attack.t1008","attack.t1546"],"path":"rules/windows/file/file_event/file_event_win_office_outlook_susp_macro_creation.yml","techniques":["T1137","T1008","T1546"],"cves":[]},{"id":"396ae3eb-4174-4b9b-880e-dc0364d78a19","title":"Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-04-05","modified":"2023-08-17","description":"Detects the modification of Outlook setting \"LoadMacroProviderOnBoot\" which if enabled allows the automatic loading of any configured VBA project/module","references":["https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53","https://www.linkedin.com/pulse/outlook-backdoor-using-vba-samir-b-/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.command-and-control","attack.t1137","attack.t1008","attack.t1546"],"path":"rules/windows/registry/registry_set/registry_set_office_outlook_enable_load_macro_provider_on_boot.yml","techniques":["T1137","T1008","T1546"],"cves":[]},{"id":"8c31f563-f9a7-450c-bfa8-35f8f32f1f61","title":"New Outlook Macro Created","author":"@ScoubiMtl","status":"test","level":"medium","date":"2021-04-05","modified":"2023-02-08","description":"Detects the creation of a macro file for Outlook.","references":["https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.persistence","attack.command-and-control","attack.t1137","attack.t1008","attack.t1546"],"path":"rules/windows/file/file_event/file_event_win_office_outlook_macro_creation.yml","techniques":["T1137","T1008","T1546"],"cves":[]},{"id":"e3b50fa5-3c3f-444e-937b-0a99d33731cd","title":"Outlook Macro Execution Without Warning Setting Enabled","author":"@ScoubiMtl","status":"test","level":"high","date":"2021-04-05","modified":"2023-08-17","description":"Detects the modification of Outlook security setting to allow unprompted execution of macros.","references":["https://www.mdsec.co.uk/2020/11/a-fresh-outlook-on-mail-based-persistence/","https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=53"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.privilege-escalation","attack.persistence","attack.command-and-control","attack.t1137","attack.t1008","attack.t1546"],"path":"rules/windows/registry/registry_set/registry_set_office_outlook_enable_macro_execution.yml","techniques":["T1137","T1008","T1546"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}