Meta tags:

Headings (most frequently used words):

exfiltration, over, other, network, medium, mitigations, detection, strategy, references, sub, techniques,

Text of the page (most frequently used words):
the (10), att (10), all (10), network (10), enterprise (8), exfiltration (8), data (7), over (7), and (6), #techniques (6), bluetooth (6), connection (6), ics (5), mobile (5), none (5), mitre (4), detection (4), wifi (4), interfaces (4), not (4), channel (4), version (4), may (4), t1011 (4), medium (4), policy (3), cti (3), mitigations (3), defenses (3), sub (3), via (3), primary (3), cellular (3), other (3), 2026 (2), corporation (2), are (2), use (2), domains (2), resources (2), reference (2), campaigns (2), software (2), groups (2), components (2), analytics (2), strategies (2), assets (2), tactics (2), matrices (2), core (2), objects (2), 2009 (2), february (2), settings (2), group (2), retrieved (2), july (2), 2018 (2), system (2), followed (2), tools (2), alternate (2), transfer (2), non (2), access (2), through (2), with (2), analytic (2), description (2), name (2), disable (2), modem (2), another (2), radio (2), frequency (2), october (2), 001 (2), adversaries (2), internet (2), command (2), control (2), for (2), ckcon (2), person (2), tickets (2), faq (2), 2015, registered, trademarks, cookie, preferences, website, changelog, privacy, terms, contact, reset, filters, schauland, configuring, wireless, microsoft, disabling, infrared, beaming, references, applescript, calls, activate, airdrop, cloud, sync, socket, blueutil, networksetup, an0214, low, level, enable, nics, pppd, hcitool, nmcli, rfkill, an0213, execution, file, activity, processes, typically, associated, such, behavior, rundll32, powershell, regsvr32, an0212, det0077, strategy, prevent, creation, new, adapters, where, possible, operating, configuration, m1028, local, computer, security, needed, within, environment, remove, feature, program, m1042, mitigation, live, permalink, 2025, last, modified, 2017, created, itzik, kotler, safebreach, contributors, linux, windows, macos, platforms, tactic, choose, this, they, have, sufficient, proximity, might, secured, defended, well, connected, because, routed, same, attempt, exfiltrate, different, than, wired, occur, example, home, open, join, mclean, hotel, location, details, can, found, register, here, search, blog, contribute, benefactors, legal, branding, updates, history, engage, advisory, council, learn, more, about, get, started, detections, technique,

Text of the page (random words):
exfiltration over other network medium technique t1011 enterprise mitre att ck matrices enterprise mobile ics tactics enterprise mobile ics techniques enterprise mobile ics defenses mitigations enterprise mobile ics assets detections detection strategies analytics data components cti groups software campaigns resources get started learn more about att ck att ck advisory council att ckcon att ck data tools faq engage with att ck version history updates legal branding benefactors contribute blog search att ckcon 7 0 in person tickets are open join us october 27 28 2026 in mclean va register here for in person tickets hotel and location details can be found in the faq home techniques enterprise exfiltration over other network medium exfiltration over other network medium sub techniques 1 id name t1011 001 exfiltration over bluetooth adversaries may attempt to exfiltrate data over a different network medium than the command and control channel if the command and control network is a wired internet connection the exfiltration may occur for example over a wifi connection modem cellular data connection bluetooth or another radio frequency rf channel adversaries may choose to do this if they have sufficient access or proximity and the connection might not be secured or defended as well as the primary internet connected channel because it is not routed through the same enterprise network id t1011 sub techniques t1011 001 ⓘ tactic exfiltration ⓘ platforms linux windows macos contributors itzik kotler safebreach version 1 2 created 31 may 2017 last modified 24 october 2025 version permalink live version mitigations id mitigation description m1042 disable or remove feature or program disable wifi connection modem cellular data connection bluetooth or another radio frequency rf channel in local computer security settings or by group policy if it is not needed within an environment m1028 operating system configuration prevent the creation of new network adapters where possible 1 2 detection strategy id name analytic id analytic description det0077 detection of exfiltration over alternate network interfaces an0212 execution of file transfer or network access activity through non primary interfaces e g wifi bluetooth cellular by processes not typically associated with such behavior e g rundll32 powershell regsvr32 an0213 use of rfkill nmcli or low level tools e g iw hcitool pppd to enable alternate interfaces followed by data transfer via non primary nics an0214 applescript or system calls to activate wifi bluetooth interfaces networksetup blueutil followed by exfiltration via airdrop cloud sync or network socket references microsoft 2009 february 9 disabling bluetooth and infrared beaming retrieved july 26 2018 schauland d 2009 february 24 configuring wireless settings via group policy retrieved july 26 2018 core objects all core att ck objects all none matrices tactics techniques sub techniques defenses all defenses all none mitigations assets detection strategies analytics data components cti all cti all none groups software campaigns reference all reference all none resources domains all domains all none enterprise mobile ics reset filters contact us terms of use privacy policy website changelog cookie preferences 2015 2026 the mitre corporation mitre att ck and att ck are registered trademarks of the mitre corporation