Establishing network connections on uncommon ports or protocols following C2 disruption or blocking. Often executed by processes that typically exhibit no network activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 |
| Network Traffic Flow (DC0078) | NSM:Flow | uncommon ports |
| Field | Description |
|---|---|
| DestinationPort | Can be tuned to include unexpected or high-entropy ports not typically associated with the process. |
| ProcessName | Useful to filter benign applications vs suspicious fallback attempts. |
| DataVolumeRatio | Tunable ratio of sent/received bytes to indicate potential C2 beaconing or exfiltration. |
| TimeWindow | Adjust temporal window to match likely fallback C2 retries after primary channel fails. |
Creation of outbound connections on alternate ports or using covert transport (e.g., ICMP, DNS) from non-network-intensive processes, following known disruption or blocked traffic.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | outbound connections |
| Network Traffic Flow (DC0078) | NSM:Flow | alternate ports |
| Field | Description |
|---|---|
| ProtocolType | Can filter for rare fallback channel types (e.g., ICMP, DNS over HTTP). |
| UserContext | Tuning by user (e.g., root vs. service account) helps suppress noise. |
Outbound fallback traffic from low-profile or background launch agents using unusual protocols or destinations after primary channel inactivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | macos:unifiedlog | None |
| Network Traffic Flow (DC0078) | NSM:Flow | None |
| Field | Description |
|---|---|
| LaunchAgentContext | Used to suppress known legitimate agents. |
| PayloadEntropy | Can help isolate covert or encrypted fallback traffic. |
Outbound traffic from host management services or guest-to-host interactions over unusual interfaces (e.g., backdoor API endpoints or external VPN tunnels).
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | esxi:vmkernel | None |
| Network Traffic Flow (DC0078) | esxi:vpxd | None |
| Field | Description |
|---|---|
| InterfaceName | May vary based on ESXi build and should be filtered to suppress known interfaces. |
| FallbackIPRanges | Environment-specific ranges to ignore (e.g., DR tunnels or out-of-band mgmt). |