Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth
- ID
- T1011.001
- Tactics
- TA0010 Exfiltration
- Sub-technique of
- T1011 Exfiltration Over Other Network Medium
- Platforms
- Linux, macOS, Windows
- Data sources
- Network Connection Creation, File Creation, Process Creation, Command Execution, File Access
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.
Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Detection
- DET0554 Detection of Bluetooth-Based Data Exfiltration
Data components: Network Connection Creation, File Creation, Process Creation, Command Execution, File Access
Mitigations (2)
- M1028 Operating System Configuration
Prevent the creation of new network adapters where possible.
- M1042 Disable or Remove Feature or Program
Disable Bluetooth in local computer security settings or by group policy if it is not needed within an environment.