title: Multiband Communication (T1026)
id: df00tech-t1026
status: experimental
description: "NOTE: This technique has been deprecated by MITRE ATT&CK and should no longer be used in new detections. The behaviors it described are now captured under more specific sub-techniques of T1071 (Application Layer Protocol) and related C2 techniques. Adversaries may split command-and-control (C2) communications between different protocols or network channels. One protocol may carry inbound commands from the operator while a separate protocol carries outbound data from the victim, allowing the adversary to evade firewall rules that inspect a single protocol or threshold-based anomaly detection on any one communication channel. The split may also be randomized across sessions to further avoid detection heuristics. Common patterns include using DNS for data exfiltration while HTTP carries commands, or combining ICMP with HTTPS, or rotating between multiple out-of-band channels based on availability or operator choice."
references:
  - https://attack.mitre.org/techniques/T1026/
  - https://df00tech.com/detections/T1026
author: df00tech
date: 2026/04/18
tags:
  - attack.t1026
# NOTE: logsource is auto-derived and may need adjustment for your environment
logsource:
  category: network_connection
  product: windows
detection:
  # This detection logic could not be auto-translated; see the KQL/SPL query on df00tech.
  selection:
    EventID: '*'
  condition: selection
falsepositives:
  - "Network monitoring or diagnostic tools (Wireshark, netstat wrappers, custom scripts) that open connections across multiple protocols as part of legitimate testing"
  - "Update clients and package managers that contact DNS resolvers and then fetch payloads over HTTPS, then may send telemetry via a separate channel"
  - "Remote management agents (Ansible, Puppet, Chef client) that may use multiple protocols during configuration application phases"
  - Security scanning tools or vulnerability assessment agents that probe multiple services simultaneously across different protocols
  - Backup agents that use separate channels for metadata (DNS/HTTP control plane) and data transfer (custom protocol over high port)
level: medium