T1011: Exfiltration Over Other Network Medium
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.
Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Analyst context for executives and security teams
This technique matters because data theft may bypass the network path an organization normally monitors. If command and control uses the enterprise wired Internet connection, an adversary with enough access or proximity may try to move data out through WiFi, modem, cellular, Bluetooth, or another RF channel that is less secured or not routed through enterprise defenses.
Executive priority
Leaders should treat this as a coverage and governance question, not only a malware question: do asset standards, OS configuration baselines, and SOC monitoring account for alternate network interfaces on Linux, macOS, and Windows systems? The business risk is that exfiltration evidence may be missing if monitoring is concentrated only on primary Internet egress points. This is especially relevant for incident response readiness, audit evidence around endpoint hardening, and environments where wireless or removable communications paths are present.
Technical view
For SOC, detection engineering, and IR teams, validate whether endpoints can use alternate network media while also connected to the enterprise network. ATT&CK provides no official detection text for T1011, but the related detection strategy DET0077 points to detecting exfiltration over alternate network interfaces. Practical validation should compare expected network paths against observed interface availability and data movement over WiFi, modem, cellular, Bluetooth, or RF-capable channels where those are present. Focus on Linux, macOS, and Windows endpoint visibility, because those are the supported platforms for this technique.
Likely telemetry
- Endpoint network interface inventory and state changes for Linux, macOS, and Windows systems
- Connection metadata showing use of WiFi, modem, cellular, Bluetooth, or other RF-capable channels where available
- Endpoint configuration evidence showing whether unused communications features are enabled or disabled
- Network egress records from primary enterprise paths to identify gaps where traffic would not be routed through normal controls
- Incident response artifacts that show concurrent or unexpected use of alternate interfaces during suspected exfiltration
Detection direction
- Validate whether DET0077-style coverage exists for exfiltration over alternate network interfaces rather than only standard enterprise Internet egress.
- Tune detections around unexpected interface activation or data transfer on non-primary network media, with environment-specific allowlists for legitimate wireless, cellular, Bluetooth, or modem use.
- Check for blind spots where alternate media are not logged, not centrally monitored, or not routed through normal enterprise controls.
- During investigations, ask whether suspected data movement could have occurred outside the command-and-control channel and outside normal network telemetry.
Mitigation priorities
- Prioritize OS configuration hardening consistent with M1028 to reduce unnecessary exposure from enabled network and communications features.
- Disable or remove unnecessary features, programs, or services consistent with M1042, especially where alternate network media are not required for business operations.
- Maintain endpoint standards that define which network interfaces are permitted on Linux, macOS, and Windows systems.
- Use compliance and configuration evidence to prove that unused communications paths are disabled or controlled, rather than assuming perimeter monitoring is sufficient.
Analyst notes and limits
The material decision point is whether the organization can see and control data movement over network media other than the primary command-and-control or enterprise Internet path. This technique is most relevant where endpoints have alternate connectivity options or where adversary proximity could make wireless or RF channels practical.
The ATT&CK object does not provide official detection guidance, procedure examples, attribution, impact claims, or evidence of active exploitation. Local endpoint inventory, interface configuration, and telemetry availability are required to determine exposure and detection coverage.
Exfiltration Over Other Network Medium
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.
Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1011.001 | Exfiltration Over Bluetooth Sub-technique | Exfiltration Over Bluetooth subtechnique of this object. |
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | c230d6c93af2… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack T1011Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.