Technique: Fallback Channels

Description

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Threat-Mapped Scoring

ATT&CK Kill Chain Metadata

• Tactics: command-and-control
• Platforms: Linux, Windows, macOS, ESXi
• Detection Guidance:
  Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. (Citation: University of Birmingham C2)

Malware

Tools

APTs (Intrusion Sets)