T1008 · Fallback Channels

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1008 · Fallback Channels · Sunturai

attack-patternenterprise-attackT1008

Fallback Channels

attack-pattern--f24faf46-3b26-4dbb-98f2-63460498e433

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

34 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
[Anomaly] Anomalous Increase in DNS activity by clients (ASIM DNS Solution)	Unknown	Microsoft Sentinel analytics	Sep 10, 2026	MIT License
Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Anomaly based (ASIM DNS Solution)	Medium	Microsoft Sentinel analytics	Sep 10, 2026	MIT License
Detect DNS queries reporting multiple errors from different clients - Anomaly Based (ASIM DNS Solution)	Medium	Microsoft Sentinel analytics	Sep 10, 2026	MIT License
Detect excessive NXDOMAIN DNS queries - Anomaly based (ASIM DNS Solution)	Medium	Microsoft Sentinel analytics	Sep 10, 2026	MIT License
Potential DGA detected (ASIM DNS Schema)	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Excessive NXDOMAIN DNS Queries (ASIM DNS Schema)	Medium	Microsoft Sentinel analytics	Sep 2, 2026	MIT License
Abnormally long DNS URI queries	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential DGA detected	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
DNS Full Name anomalous lookup increase	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
DNS - domain anomalous lookup increase	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
DNS lookups for commonly abused TLDs	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential DGA detected	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Squid commonly abused TLDs	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Squid proxy events for ToR proxies	Low	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Excessive NXDOMAIN DNS Queries	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential beaconing activity (ASIM DNS Solution)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Possible DNS Tunneling or Data Exfiltration Activity (ASIM DNS Solution)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Increase in DNS Requests by client than the daily average count (ASIM DNS Solution)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Top 25 Domains with large number of Subdomains (ASIM DNS Solution)	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Potential DGA(Domain Generation Algorithm) detected via Repetitive Failures - Static threshold based (ASIM DNS Solution)	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Detect DNS queries reporting multiple errors from different clients - Static threshold based (ASIM DNS Solution)	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Detect excessive NXDOMAIN DNS queries - Static threshold based (ASIM DNS Solution)	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Contrast ADR - Security Incident Alert	Medium	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Contrast ADR - DLP SQL Injection Correlation	High	Microsoft Sentinel analytics	Aug 29, 2026	MIT License
Contrast ADR - Exploited Attack in Production	High	Microsoft Sentinel analytics	Aug 29, 2026	MIT License

Showing 25 of 34

Filter in the catalogue

External references

mitre-attackT1008Open reference

University of Birmingham C2Open reference

Platforms

ESXiLinuxmacOSWindows

Kill chain phases

command-and-control

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object