MITRE ATT&CKsub-technique
T1011.001 Exfiltration Over Bluetooth
- Domain
- enterprise
- Tactics
- Exfiltration
- Platforms
- Linux, macOS, Windows
- Version
- 1.2
- Created
- 2020-03-09
Description
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.
Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Related
Subtechnique of · MITRE ATT&CK (1)
- T1011 Exfiltration Over Other Network Medium technique
Tactic · MITRE ATT&CK (1)
- TA0010 Exfiltration tactic
Referenced by MITRE ATT&CK · mitigates (2)
Referenced by MITRE ATT&CK · uses (1)
- S0143 Flame software (malware)
Referenced by Compliance · mitigates (9)
- CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
- NIST-AC-18 Wireless Access NIST 800-53 control
- NIST-CM-2 Baseline Configuration NIST 800-53 control
- NIST-CM-6 Configuration Settings NIST 800-53 control
- NIST-CM-7 Least Functionality NIST 800-53 control
- NIST-CM-8 System Component Inventory NIST 800-53 control
- NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
- NIST-SI-3 Malicious Code Protection NIST 800-53 control
- NIST-SI-4 System Monitoring NIST 800-53 control