T1011 — Exfiltration Over Other Network Medium

coverage gap

Technique: T1011
Tactics: Exfiltration
MISP citations: 0
KEV CVEs mapped: 4
Community rules: 0
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1011

MITRE description

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.

KEV CVEs mapped to this technique

Per MITRE CTID's hand-curated KEV→ATT&CK mappings — these are the actively-exploited vulnerabilities behind this technique's KEV signal.

Detection coverage

thrunt disposition — no rule banked

medium attribution absent from standard telemetry; exfil semantics need aggregation — RF/NAC control class

T1011 asks whether data left over a different physical medium than the C2 channel — WiFi from a wired host, Bluetooth, cellular, arbitrary RF. The defining fact of the technique, which interface carried the bytes, is not a field in any standard Sigma logsource: Sysmon network events, Zeek, proxy, and firewall logs record endpoints and payload metadata, not radio-versus-wire. Establishing that a transfer was exfiltration on a second medium would additionally require volume or destination baselining across events — aggregation, outside base Sigma by design. The KEV signal mapped here is real but oblique: the Zyxel DSL CPE command injections (CVE-2024-40890/40891) and the Linux kernel HID/ALSA bugs from the Cellebrite exploitation chain (CVE-2024-50302, CVE-2024-53150) involve alternate-medium devices, but none of them produces an enterprise host event a rule could match. The one host-visible fragment — staging an alternate medium via 'netsh wlan set/start hostednetwork' — has zero SigmaHQ coverage, but it is channel setup on one OS, not exfiltration, and publishing it as T1011 coverage would overstate what it sees. This is a sensor-class gap, not an authoring gap: the control that sees RF-side exfiltration is a wireless IDS or a NAC posture that prevents dual-homing, not a SIEM field match.

Compensating controls

Wireless IDS / rogue-AP detection on the RF side
802.1x/NAC policy blocking simultaneous wired+wireless (dual-homing) on managed endpoints
EDR device control alerting on new Bluetooth/cellular/USB-modem interface additions
Host firewall and OS policy denying Internet Connection Sharing and packet forwarding

Revisit when: A supported Sigma logsource convention for Microsoft-Windows-WLAN-AutoConfig/Operational (EID 8001/8003) or NetworkManager equivalents in the consumer base — or MISP/family evidence of hosted-network staging in an active campaign — would justify authoring the netsh-hostednetwork channel-setup rule as an honestly-labeled ancillary detection.

Signal counts reflect the current corpus snapshot: MISP citations are regex-extracted from CIRCL OSINT event text and galaxy tags; KEV mappings come from MITRE CTID; community coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting collections) at release —. Rule bodies are not mirrored — links go upstream.