AN0212: Analytic 0212
Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).
Analyst context for executives and security teams
This analytic highlights a Windows behavior that can matter when data movement or network access occurs over secondary interfaces such as WiFi, Bluetooth, or cellular, especially when initiated by processes that normally should not perform that activity, such as rundll32, powershell, or regsvr32. For leaders, the value is not that this proves malicious activity, but that it tests whether the organization can see and explain network paths outside the primary managed interface.
Executive priority
Prioritize this as a coverage and resilience question: can the business detect and investigate Windows systems using non-primary network interfaces for file transfer or network access? This is relevant to incident response readiness, audit evidence for endpoint/network monitoring, and control prioritization around unmanaged or alternate connectivity paths. Because ATT&CK provides no official detection logic or relationship context for this analytic, it should be treated as a validation target rather than a ready-made detection.
Technical view
For SOC, detection engineering, and IR teams, validate whether Windows telemetry can correlate process identity with network interface type and network activity. Focus on uncommon combinations: file transfer or network access over WiFi, Bluetooth, or cellular by processes not typically associated with that behavior, including rundll32, powershell, and regsvr32 as examples from the ATT&CK description. Since tactics and detection text are not specified, teams should baseline normal administrative and enterprise software behavior before escalating alerts.
Likely telemetry
- Windows process creation and command-line telemetry
- Endpoint network connection telemetry mapped to process identity
- Network interface inventory and connection state telemetry, including WiFi, Bluetooth, and cellular where available
- File transfer or network access logs from endpoint, EDR, proxy, firewall, or network monitoring sources
- Asset context showing expected network interfaces and approved connectivity methods
Detection direction
- Confirm that endpoint and network tools can distinguish primary from non-primary interfaces on Windows systems.
- Tune for processes performing network access that are unusual for the environment, using the ATT&CK examples rundll32, powershell, and regsvr32 as starting points rather than a complete list.
- Reduce false positives by accounting for legitimate administration, software update mechanisms, VPN clients, device management tools, and approved mobile connectivity use cases.
- Validate alert enrichment includes host, user, process, command line, interface type, destination, and file transfer context when available.
- Document blind spots where Bluetooth, cellular, or WiFi activity is not logged or cannot be tied back to a process.
Mitigation priorities
- Inventory Windows systems with non-primary network interfaces and define where such connectivity is approved.
- Restrict or govern unauthorized alternate network paths through endpoint configuration, network policy, and device management where business requirements allow.
- Harden monitoring for high-risk scriptable or proxy-capable Windows processes that can initiate network access.
- Ensure incident response playbooks include checks for alternate interfaces when investigating suspicious network activity or unexplained data movement.
- Use findings as compliance and readiness evidence showing whether the organization can monitor and control secondary connectivity paths.
Analyst notes and limits
This Glexia take is based only on ATT&CK analytic AN0212. The object describes suspicious Windows network or file-transfer activity through non-primary interfaces by processes not typically associated with that behavior. No ATT&CK tactics, relationships, aliases, labels, or official detection logic were supplied, so local baselining and telemetry validation are essential.
The supplied ATT&CK fields do not identify associated techniques, adversaries, campaigns, detections, mitigations, or active exploitation. The analytic is Windows-scoped only. Any assessment of risk, prevalence, or detection coverage requires environment-specific evidence.
Analytic 0212
Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 7b3e663c4a86… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0212Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.