tfMITRE ATT&CK technique
Exfiltration Over Other Network Medium T1011
- Tactic
- Exfiltration
- Platforms
- Linux, macOS, Windows
- Version
- 1.2
- Created
- 31 May 2017
- Last modified
- 24 October 2025
- Contributor
- Itzik Kotler, SafeBreach
Sub-techniques 11 rules across the family · 1 mapped directly to T1011 · 0 of 1 carry rules
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.