tfMITRE ATT&CK technique

Exfiltration Over Other Network Medium T1011

Tactic: Exfiltration
Platforms: Linux, macOS, Windows
Version: 1.2
Created: 31 May 2017
Last modified: 24 October 2025
Contributor: Itzik Kotler, SafeBreach

Sub-techniques 11 rules across the family · 1 mapped directly to T1011 · 0 of 1 carry rules

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Offense vs defense T1011

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1

first rule: 2026 Q2

Exfiltration Over Other Network Medium detection strategy DET0077

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Exfiltration Over Alternate Network Interfaces

Enterprise

3 platforms

AN0212 · Windows

Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Network Connection CreationDC0082	WinEventLog:Sysmon	EventCode=3, 22
Network Traffic ContentDC0085	WinEventLog:System	EventCode=5005 (WLAN), EventCode=302 (Bluetooth)

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
InterfaceType	Filter for specific interface categories (e.g., WiFi, Bluetooth, 4G).
FileSizeThreshold	Tunable for environment-specific large file access events pre-transfer.
TimeWindow	Temporal correlation window for file read followed by network activity.

AN0213 · Linux

Use of rfkill, nmcli, or low-level tools (e.g., iw, hcitool, pppd) to enable alternate interfaces followed by data transfer via non-primary NICs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	auditd:SYSCALL	None
Network Traffic FlowDC0078	NSM:Flow	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandPattern	Match known interface manipulation utilities or driver invocations.
NetworkDevice	Tunable to non-default or rarely used interfaces (e.g., wlan1, hci0).

AN0214 · macOS

AppleScript or system calls to activate WiFi/Bluetooth interfaces (networksetup, blueutil), followed by exfiltration via AirDrop, cloud sync, or network socket.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Host StatusDC0018	macos:osquery	interface_details
Process CreationDC0032	macos:osquery	process_events
Network Traffic ContentDC0085	macos:unifiedlog	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
Protocol	Protocol used for exfil (e.g., AirDrop, mDNS, Apple File Service).
InterfaceActivityWindow	Time period between interface activation and transfer.

Exfiltration Over Other Network Medium detections T1011

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs