MITRE ATT&CK technique · Command and Control

`T1008` Fallback Channels

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

Mini Shai-Hulud

Sigma rules to hunt it

Outlook Macro Execution Without Warning Setting Enabledhightest · windows
Potential Persistence Via Outlook LoadMacroProviderOnBoot Settinghightest · windows
Suspicious Outlook Macro Createdhightest · windows
New Outlook Macro Createdmediumtest · windows

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.