Exfiltration Over Other Network Medium
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
This technique is fundamentally about which physical network interface carried the traffic, and none of the three per-platform analytics has a log source in the brief that records that. Windows AN0212's own InterfaceType knob wants WiFi vs. Bluetooth vs. cellular, but Sysmon EventID 3/22 (network_connection, dns_query) are socket-level -- SourceIp/DestinationIp/Initiated -- with no interface identity, so the selector MITRE describes cannot be built on them; the brief's fallback, System EventID 5005 (WLAN) / 302 (Bluetooth), has no established field vocabulary anywhere in this corpus and Windows WLAN/Bluetooth connection-state events are not documented as living on the System channel under those numbers, so writing selectors against them risks the dead-selector trap rather than avoiding it. […]
What the technique is
Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN0212
Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).
- AN0213
Use of rfkill, nmcli, or low-level tools (e.g., iw, hcitool, pppd) to enable alternate interfaces followed by data transfer via non-primary NICs.
- AN0214
AppleScript or system calls to activate WiFi/Bluetooth interfaces (networksetup, blueutil), followed by exfiltration via AirDrop, cloud sync, or network socket.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.