T1011 · Exfiltration Over Other Network Medium

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1011 · Exfiltration Over Other Network Medium · Sunturai

attack-patternenterprise-attackT1011

Exfiltration Over Other Network Medium

attack-pattern--51ea26b1-ff1e-4faa-b1a0-1114cd298c87

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.

Created: May 31, 2017, 9:30 PM UTC
Modified: Oct 24, 2025, 5:48 PM UTC

1 sub-technique under this technique

Each is its own technique in the catalogue, with its own detections.

T1011.001Exfiltration Over Bluetooth

6 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Spike in Bytes Sent to an External Device via Airdrop	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Powercat Download	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Nishang Reverse TCP Shell in Base64	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Invoke-PowerShellTcpOneLine Usage.	Unknown	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
SonicWall - Allowed SSH, Telnet, and RDP Connections	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License
Windows Network Connection From Program In Suspect Location	Informational	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 6 of 6

Filter in the catalogue

External references

mitre-attackT1011Open reference

Platforms

LinuxmacOSWindows

Kill chain phases

exfiltration

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object