T1011.001: Exfiltration Over Bluetooth
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.
Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Analyst context for executives and security teams
Exfiltration Over Bluetooth matters because it moves data outside the normal enterprise network path. If an adversary has local access and physical proximity, Bluetooth can become a bypass around perimeter logging, proxy controls, and network egress monitoring that leaders often rely on as evidence of data-loss coverage.
Executive priority
Treat this as a control-assurance issue for endpoints that can access sensitive data and have Bluetooth enabled. The business question is not only whether internet egress is monitored, but whether alternate local communication channels are governed, logged, and disabled where unnecessary. This is most relevant to operational resilience, insider/nearby-device risk, incident scoping, and audit evidence for endpoint hardening on Linux, macOS, and Windows systems.
Technical view
ATT&CK provides no official detection text for T1011.001, but the object is related to DET0554, Detection of Bluetooth-Based Data Exfiltration. SOC and IR teams should validate whether endpoint telemetry can show Bluetooth adapter state, pairing activity, connection events, file-transfer activity, and unusual data movement to paired devices. Detection engineering should prioritize systems with sensitive data access and compare Bluetooth activity against expected business use. Because this is a sub-technique of Exfiltration Over Other Network Medium, teams should avoid assuming network egress tools alone cover the behavior.
Likely telemetry
- Endpoint operating system configuration state for Bluetooth enablement on Linux, macOS, and Windows
- Bluetooth pairing, connection, and device trust events where available
- Endpoint file access and file-transfer evidence associated with Bluetooth-capable workflows
- Asset inventory identifying systems where Bluetooth is enabled or required
- Incident response collection from endpoints when network logs do not explain suspected data loss
Detection direction
- Validate whether DET0554-style Bluetooth exfiltration detection is implementable with currently collected endpoint telemetry.
- Tune for unauthorized or unusual Bluetooth use on systems handling sensitive data rather than alerting on all Bluetooth activity.
- Correlate Bluetooth events with file access, compression, staging, or removable/local transfer indicators when available.
- Document blind spots where Bluetooth events are not logged, retained, or centrally collected.
- Account for legitimate peripherals and approved business use to reduce false positives.
Mitigation priorities
- Use Operating System Configuration to harden Bluetooth settings on Linux, macOS, and Windows endpoints.
- Disable or remove Bluetooth functionality where it is not required for business operations.
- Apply stricter configuration baselines to endpoints with access to sensitive data.
- Maintain asset and exception records so compliance and IR teams can distinguish approved Bluetooth use from unknown exposure.
- Review endpoint hardening evidence periodically because network security controls may not observe this channel.
Analyst notes and limits
The supplied ATT&CK relationships include mitigations M1028 and M1042, a detection strategy relationship to DET0554, a parent technique T1011, and a software relationship showing Flame uses this technique. The Flame relationship should be treated as ATT&CK context, not as evidence of current activity in any environment.
MITRE does not provide official detection text for this object. Bluetooth monitoring capabilities vary by operating system, endpoint configuration, and telemetry collection. Local asset context, approved peripheral use, and data sensitivity are required to determine priority and detection quality.
Exfiltration Over Bluetooth
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.
Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1011 | Exfiltration Over Other Network Medium | This object subtechnique of Exfiltration Over Other Network Medium. |
Groups, software, and campaigns
S0143: Flame
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 60d43b77ce24… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack T1011.001Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.