Exfiltration Over Other Network Medium (T1011) moves data out through a link your proxy, firewall and network DLP never see: a second Wi-Fi network, a cellular modem, a tethered phone or a Bluetooth connection. MITRE ATT&CK describes it as exfiltrating over a different network medium from the command and control channel, chosen because that connection "might not be secured or defended as well" when it is not routed through the enterprise network. Its one sub-technique, T1011.001 Exfiltration Over Bluetooth, needs only proximity. This guide is for endpoint engineers, detection engineers and insider risk teams. It covers which alternate media exist on modern laptops and servers, the Windows, macOS and Linux settings that close them, ATT&CK's detection analytics, a staged rollout and how to investigate a hit. For the full exfiltration lifecycle see the Data Exfiltration Guide.
Key takeaways
- The control point is the endpoint, not the network. Traffic over a hotspot, cellular modem or Bluetooth link never crosses the corporate egress path, so only device configuration and endpoint telemetry can see or stop it.
- ATT&CK's mitigations are configuration, not products. M1042 says to disable Wi-Fi, modem, cellular, Bluetooth or other RF channels where they are not needed, and M1028 says to prevent the creation of new network adapters where possible.
- Simultaneous connections are the core risk. A device joined to the corporate network and a personal hotspot at the same time can stage data from internal shares and send it out the side door. Windows Connection Manager policy can block that combination.
- Detection is a correlation, not a single event. ATT&CK's analytics pair an alternate interface being enabled, or an unusual process using it, with recent file access or staging by the same user or session.
- Allow by role, not by default. Most office laptops need Wi-Fi and Bluetooth for headsets, very few need Bluetooth file transfer, Wi-Fi Direct or Internet Connection Sharing. Restrict profiles, not radios, where users depend on them.
What T1011 covers and where it sits
ATT&CK v20 places T1011 in the Exfiltration tactic on Linux, macOS and Windows. Its examples are a Wi-Fi connection, a modem, a cellular data connection, Bluetooth or another radio frequency channel, used when the command and control path is a wired internet connection. The only software procedure example is on the sub-technique: Flame (S0143), whose BeetleJuice module ATT&CK describes as able to transmit encoded information over Bluetooth, act as a Bluetooth beacon and identify nearby Bluetooth devices. In practice the technique is as relevant to insiders, who have proximity by definition, as to remote intruders.
| Technique | Path the data takes | Who can see it | Where to control it |
|---|---|---|---|
| T1011 Exfiltration Over Other Network Medium | A second network interface: hotspot, cellular, Bluetooth, other RF | Only the endpoint | Device configuration and endpoint telemetry |
| T1052 Exfiltration Over Physical Medium | Removable media such as USB storage | Endpoint device control | Device control policy |
| T1041 Exfiltration Over C2 Channel | The existing command and control connection | Proxy, firewall, network monitoring | Egress filtering and C2 detection |
| T1048 Exfiltration Over Alternative Protocol | A different protocol on the corporate network, such as DNS or FTP | Network monitoring | Egress protocol allowlists |
| T1567 Exfiltration Over Web Service | Legitimate cloud and web services | Proxy, CASB, network DLP | Web and SaaS controls |
T1011 is the one row where network controls see nothing. See the Removable Media and USB Control Guide guide for removable media and the MITRE ATT&CK T1048 Exfiltration Over Alternative Protocol guide for protocol-based routes.
The alternate media on a typical estate
| Medium | How it bypasses egress controls | Main preventive setting | What to watch |
|---|---|---|---|
| Second Wi-Fi network or personal hotspot | Laptop on wired corporate LAN joins a phone hotspot or open network | Block simultaneous domain and non-domain connections; restrict to managed Wi-Fi profiles | New SSIDs, interface changes, traffic on the non-primary interface |
| Built-in cellular modem (WWAN) | Direct mobile data path, always available | Disallow cellular data where not needed, or route it through the corporate VPN | Cellular interface up while on the corporate network |
| Phone tethering over USB or Bluetooth | Creates a new network adapter on demand | Prevent creation of new adapters (M1028), device control for network-class USB | New adapter installation events, unknown interface in inventory |
| Bluetooth file transfer (OBEX) | Point-to-point file push to a nearby device | Bluetooth service allowlist without OBEX profiles | Bluetooth connections by non-interactive processes after file staging |
| Wi-Fi Direct and proximity sharing | Device-to-device link without an access point | Disallow Wi-Fi Direct; block AirDrop on managed Macs | Proximity sharing events in endpoint logs |
| Internet Connection Sharing and network bridges | Turns the host into a router between networks | Block Internet Connection Sharing and network bridge configuration | Service and configuration changes |
Servers deserve a separate pass. A server with a Wi-Fi card or a cellular modem left over from a build or a vendor appliance is a T1011 path in a data centre, and in OT sites cellular gateways are common. See the Cellular Router and Gateway Hardening Guide.
Preventive settings by platform
Windows (Policy CSP and Group Policy)
- Block simultaneous domain and non-domain connections: the Windows Connection Manager policy "Prohibit connection to non-domain networks when connected to domain authenticated network" (Computer Configuration, Network, Windows Connection Manager; registry value fBlockNonDomain; CSP name ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork, spelled that way in Microsoft's docs). Microsoft documents that when it is not configured, computers may connect to domain and non-domain networks simultaneously. Note Microsoft's behaviour for manual connections: over Ethernet the existing connection is kept and the new one blocked, over other media the existing connection is dropped.
- Restrict Bluetooth by service: the Bluetooth CSP ServicesAllowedList takes a semicolon-delimited list of profile UUIDs and only listed services can pair and connect. Microsoft's docs list OBEX Object Push (0x1105), OBEX (0x0008) and PnP Information (0x1200) as the UUIDs needed for file transfer, so an allowlist built for headsets, keyboards and mice without the OBEX entries disables Bluetooth file send and receive. Connectivity/AllowBluetooth set to 0 removes Bluetooth entirely where no peripherals are needed.
- Reduce discoverability: Bluetooth AllowDiscoverableMode and AllowAdvertising set to 0 stop the device announcing itself to nearby devices.
- Restrict Wi-Fi: Wifi/AllowWiFiDirect 0 blocks Wi-Fi Direct; Wifi/AllowManualWiFiConfiguration 0 limits connections to MDM-provisioned networks (Microsoft warns it deletes user-configured profiles, so deploy corporate profiles first); Wifi/AllowInternetSharing blocks Internet Connection Sharing.
- Cellular and bridging: Connectivity/AllowCellularData 0 blocks cellular data and stops the user turning it on; ProhibitInstallationAndConfigurationOfNetworkBridge stops users creating a network bridge, though Microsoft notes it does not remove an existing one.
Confirm current values and supported Windows versions in Microsoft's Policy CSP documentation before deployment. See the Microsoft Intune Guide for delivery.
macOS
Apple's Platform Deployment documentation lists restrictions for enrolled Macs that do not require supervision: AirDrop (macOS 10.13 and later, users cannot use AirDrop), Allow Bluetooth modification and Allow Internet sharing modification (macOS 14 and later, users cannot change those settings) and File Sharing modification (macOS 14). Pair them with a managed Wi-Fi configuration and endpoint telemetry. See the macOS Security Guide for Enterprises.
Linux
For servers, the most reliable control is not to have the radio: remove or disable wireless and Bluetooth hardware and modules in the build. For Linux laptops, manage radios and network connections through the configuration management tool already used for the fleet and alert on the user-space tools ATT&CK's analytics name for enabling interfaces and Bluetooth (such as rfkill, nmcli, bluetoothctl and hcitool) when used outside an approved context.
Detection: what ATT&CK's analytics look for
ATT&CK v20 attaches two detection strategies: Detection of Exfiltration Over Alternate Network Interfaces (T1011) and Detection of Bluetooth-Based Data Exfiltration (T1011.001).
| Platform | Behaviour ATT&CK describes | Telemetry it names |
|---|---|---|
| Windows | File transfer or network activity through Wi-Fi, Bluetooth or cellular interfaces by processes not normally associated with it (examples given: rundll32, powershell, regsvr32); non-interactive processes using Bluetooth after file access or staging | Sysmon network connection, DNS and file creation events; System log WLAN and Bluetooth events |
| Linux | rfkill, nmcli or low-level tools enabling alternate interfaces followed by transfer over a non-primary interface; Bluetooth tools initialising a connection paired with recent file reads by the same user or session | auditd SYSCALL records, network flow data, syslog, osquery |
| macOS | Scripts or system calls activating Wi-Fi or Bluetooth (networksetup, blueutil) followed by AirDrop, cloud sync or socket transfer, especially by non-GUI processes after large file reads | Unified log, osquery process events and interface details |
Turning the analytics into rules
- Maintain an interface inventory: collect each endpoint's network interfaces, their type and whether they are up, through osquery or your EDR, and alert on new interface types appearing on server and high-risk user groups. See the osquery Guide.
- Attribute connections to interfaces: enrich endpoint network events with the interface or local address, so connections leaving through a non-primary interface can be counted per process and user. See the Sysmon Guide.
- Correlate with staging: the strongest signal is archive creation or bulk file reads followed within a short window by an alternate interface coming up and outbound volume on it. Neither half is reliable on its own.
- Watch for policy drift: alert when Bluetooth, Wi-Fi Direct, Internet Connection Sharing or the simultaneous connection setting changes from the managed baseline on a device.
- Use wireless monitoring for sensitive spaces: wireless intrusion detection can spot unexpected hotspots near data rooms and labs. See the Wireless intrusion detection guide.
Rolling it out
- Inventory: list radios and modems by device model and role, and which Bluetooth profiles users actually use (headsets, keyboards, mice, pens).
- Decide profiles: define two or three device profiles, for example standard laptop, high-risk data handler and server, with the settings for each (see the decision table).
- Audit first: deploy telemetry and the detection rules before any blocking, and run them for two to four weeks to see real use of tethering, hotspots and Bluetooth transfer (NHI Mgmt Group recommendation).
- Pilot ring: apply the settings to IT and security staff, then a business pilot group. Deploy managed Wi-Fi profiles before restricting manual Wi-Fi configuration.
- Enforce by ring: widen in stages, with an exception process that has an owner, a business reason and an expiry date.
- Rollback: keep each setting in a separate configuration profile or policy so a single setting can be withdrawn from a ring without undoing the rest.
Decision guidance
| Device profile | Bluetooth | Wi-Fi | Cellular and tethering |
|---|---|---|---|
| Standard office laptop | On, service allowlist without OBEX, not discoverable | On, block simultaneous domain and non-domain connections, Wi-Fi Direct off | Cellular through VPN only; adapter creation monitored |
| High-risk data handler (finance, R&D, privileged admin) | Peripherals only, or off | Managed profiles only | Off; new adapters blocked where possible |
| Server and appliance | Hardware removed or disabled | Hardware removed or disabled | None; any new interface is an incident |
Small organisations without a detection team gain most from the preventive settings alone. Larger organisations with an insider risk programme should invest in the correlation rules, because blocking every medium for every user is rarely accepted. See the Insider Threat Programme Guide.
Investigating a hit
- Establish the sequence: what was read or staged, when the alternate interface came up, which process sent data over it and how much.
- Identify the other end: SSID and hotspot name, Bluetooth device name and address, or cellular interface. Paired device lists and wireless profile history on the endpoint are key evidence; collect them before any reimage.
- Check identity context: whether the user or a service account ran the process, whether the account was recently granted access to the data, and whether the device was out of compliance.
- Scope the data: use file access logs and staging artefacts to estimate what left, then follow the Data Exfiltration Playbook. For suspected insiders, involve HR and legal early and follow the Insider Data Theft Response Playbook.
Metrics that show it is working
- Baseline compliance: percentage of devices per profile with the alternate media settings in force. Target above 95% for servers and high-risk handlers.
- Simultaneous connection exposure: devices observed connected to the corporate network and a non-corporate network at the same time, per week.
- Unexpected interfaces: new interface types on servers or high-risk devices. Target zero outside approved changes.
- Exception hygiene: share of exceptions with an owner and an unexpired end date.
- Rule precision: proportion of correlation alerts closed as legitimate use, reviewed monthly to tune the rules.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK mitigation |
|---|---|---|---|
| Disable unneeded radios and services | AC-18(3) Disable Wireless Networking; CM-7 Least Functionality | PR.PS-01 | M1042 Disable or Remove Feature or Program |
| Stop users changing wireless settings | AC-18(4) Restrict Configurations by Users | PR.PS-01 | M1028 Operating System Configuration |
| Mobile and portable devices | AC-19 Access Control for Mobile Devices | PR.PS-01 | M1028 Operating System Configuration |
| Prevent dual-homed connections | SC-7(7) Split Tunneling for Remote Devices | PR.IR-01 | M1028 Operating System Configuration |
| Interface and hardware inventory | CM-8 System Component Inventory | ID.AM-01 | Not applicable |
| Monitoring | SI-4 System Monitoring | DE.CM-03; DE.CM-09 | M1057 Data Loss Prevention (supporting) |
NIST SP 800-121 Rev. 2, Guide to Bluetooth Security (final, Update 1 of January 2022), covers Bluetooth security modes and pairing in depth; see also the Bluetooth, RFID and NFC Security Guide.
Common failure patterns
- Relying on network DLP: network DLP and proxies cannot see a hotspot or Bluetooth path. Endpoint DLP and device configuration have to carry it. See the Endpoint DLP Guide.
- Blocking the radio, breaking the headset: turning Bluetooth off for everyone triggers mass exceptions. A service allowlist without OBEX keeps peripherals working.
- Restricting manual Wi-Fi before deploying corporate profiles: Microsoft warns the setting deletes user-configured profiles, which can take devices offline.
- Forgetting servers and appliances: leftover wireless cards and cellular modems on servers are rarely inventoried.
- Single-event alerts: alerting on every interface change floods analysts. Correlate with staging and volume.
- Exceptions with no expiry: temporary tethering approvals become permanent.
Practitioner checklist
- Inventory radios, modems and network adapters by device model and role, including servers.
- Turn on the Windows Connection Manager setting that blocks simultaneous domain and non-domain connections.
- Deploy a Bluetooth service allowlist without OBEX profiles, and remove Bluetooth where no peripherals are needed.
- Disable Wi-Fi Direct, Internet Connection Sharing and network bridge creation on managed Windows devices.
- Apply AirDrop, Bluetooth and Internet sharing modification restrictions to enrolled Macs.
- Remove or disable wireless and cellular hardware on servers and appliances.
- Collect interface inventory and interface-attributed network events, and build the staging-plus-interface correlation rule.
- Run audit, pilot and staged enforcement with an exception process that has owners and expiry dates.
Standards and references
- MITRE ATT&CK: Exfiltration Over Other Network Medium (T1011)
- MITRE ATT&CK: Exfiltration Over Bluetooth (T1011.001)
- NIST: SP 800-121 Rev. 2, Guide to Bluetooth Security
- Microsoft: Policy CSP, WindowsConnectionManager
- Microsoft: Policy CSP, Bluetooth
- Microsoft: Policy CSP, Wifi
- Microsoft: Policy CSP, Connectivity
- Apple: Restrictions for Mac computers
Related NHI Mgmt Group resources: Data Exfiltration Guide · Insider Data Theft Guide · Removable Media and USB Control Guide · Endpoint Security Guide