Exfiltration Over Other Network Medium (T1011) is an exfiltration technique. Adversaries try to move data over a different network medium than the command and control channel. MITRE lists Linux, macOS and Windows.
How attackers use it
If the C2 channel runs over a wired internet connection, exfiltration might happen over WiFi, a modem, a cellular data connection, Bluetooth or another radio frequency channel. MITRE says adversaries may choose this when they have sufficient access or proximity, and because the connection might not be secured or defended as well as the primary channel, since it does not route through the same enterprise network.
That second reason is the one for defenders to remember. Your network monitoring only sees traffic that crosses your network.
How to detect it
MITRE's analytic looks at transfers from a host that use interfaces that are not the primary one:
- Windows: file transfer or network activity over non-primary interfaces such as WiFi, Bluetooth or cellular by processes not usually involved, for example rundll32, powershell or regsvr32.
- Linux: use of rfkill, nmcli, or low-level tools such as iw, hcitool and pppd to enable alternate interfaces, followed by data transfer.
- macOS: AppleScript or system calls that turn on WiFi or Bluetooth with networksetup or blueutil, followed by transfer through AirDrop, cloud sync or a network socket.
Endpoint logs are the main source. Watch for new network adapters appearing, for interfaces coming up on servers that should have one, and for adapter changes on a machine that is also carrying out file staging.
How to reduce the risk
MITRE lists:
- Disable or Remove Feature or Program: disable WiFi, modem, cellular, Bluetooth or other radio channels in local computer security settings or group policy when they are not needed.
- Operating System Configuration: prevent the creation of new network adapters where possible.
Servers and fixed workstations rarely need WiFi or Bluetooth. Turn them off in the firmware or by policy.
Quick check
Why is a secondary network medium attractive for exfiltration?
It may not be routed through the enterprise network, so it may be less defended and less monitored than the primary connection.
