T1008 Fallback Channels

Technique

T1008

Tactics

Command and Control

Research, 90 days

1

KEV CVEs mapped

0

SigmaHQ rules

4

Elastic, Splunk

1

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1008

MITRE description

Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

Detection coverage

SigmaHQ community rules

• New Outlook Macro Created (core)
• Suspicious Outlook Macro Created (core)
• Potential Persistence Via Outlook LoadMacroProviderOnBoot Setting (core)
• Outlook Macro Execution Without Warning Setting Enabled (core)

Elastic and Splunk rules

• Windows Outlook Macro Security Modified (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.