Techniques › T1011
T1011 Exfiltration Over Other Network Medium
exfiltration — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1011
4
KEV CVEs mapped here
<p>Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.</p><p>Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2024-53150 | Linux Kernel | secondary impact | Mapped | 2025-04-09 |
| CVE-2024-50302 | Linux Kernel | secondary impact | Mapped | 2025-03-04 |
| CVE-2024-40891 | Zyxel DSL CPE Devices | primary impact | Mapped | 2025-02-11 |
| CVE-2024-40890 | Zyxel DSL CPE Devices | primary impact | Mapped | 2025-02-11 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0077 Detection of Exfiltration Over Alternate Network Interfaces v1.0
AN0212 WindowsExecution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).WinEventLog:System
EventCode=5005 (WLAN), EventCode=302 (Bluetooth)→ DC0085 Network Traffic ContentTunable:InterfaceTypeFileSizeThresholdTimeWindowAN0213 LinuxUse ofrfkill,nmcli, or low-level tools (e.g.,iw,hcitool,pppd) to enable alternate interfaces followed by data transfer via non-primary NICs.Tunable:CommandPatternNetworkDeviceAN0214 macOSAppleScript or system calls to activate WiFi/Bluetooth interfaces (networksetup,blueutil), followed by exfiltration via AirDrop, cloud sync, or network socket.Tunable:ProtocolInterfaceActivityWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1011
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content. 4 actively exploited CVEs map here.
Sub-techniques
| ID | Name | Sigma rules | KEV CVEs |
|---|---|---|---|
| T1011.001 | Exfiltration Over Bluetooth | 0 | 0 |