Exfiltration Over Other Network Medium T1011

Tactic: Exfiltration

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.

Events covered

1 catalog event is tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 3Network connection

Authoring guide

These 3 rules share fields, values, and exclusions.

Fields filtered most (7 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
All_Traffic.app1in 1*\\$recycle.bin\\*, *\\config\\systemprofile\\*, *\\perflogs\\*
DstPortNumber1in 122, 23, 3389
EventOriginalType1ne 11370
EventResult1in 1NA, Success
NetworkDirection1eq 1Inbound
SrcAppName1contains 1bitvise ssh, ssh protocol, telnet
ThreatId1ne 1446

Top indicator values (21 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
All_Traffic.appin
*\\$recycle.bin\\*
1
All_Traffic.appin
*\\config\\systemprofile\\*
1
All_Traffic.appin
*\\perflogs\\*
12
All_Traffic.appin
*\\users\\all users\\*
1
All_Traffic.appin
*\\users\\default\\*
1
All_Traffic.appin
*\\users\\public\\*
1
All_Traffic.appin
*\\windows\\addins\\*
1
All_Traffic.appin
*\\windows\\fonts\\*
1
All_Traffic.appin
*\\windows\\ime\\*
1
DstPortNumberin
22
13
DstPortNumberin
23
12
DstPortNumberin
3389
12
EventOriginalTypene
1370
1
EventResultin
NA
1
EventResultin
Success
1
NetworkDirectioneq
Inbound
12
SrcAppNamecontains
bitvise ssh
1
SrcAppNamecontains
ssh protocol
1
SrcAppNamecontains
telnet
1
SrcAppNamecontains
windows remote desktop services
1
ThreatIdne
446
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Elastic 1 rule

Splunk 1 rule

Kusto 1 rule