Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0077 — Detection of Exfiltration Over Alternate Network Interfaces
DET0077

Detection of Exfiltration Over Alternate Network Interfaces

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN0212 Analytic 0212
Windows

Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).

WinEventLog:Sysmon EventCode=3, 22 WinEventLog:System EventCode=5005 (WLAN), EventCode=302 (Bluetooth) WinEventLog:Sysmon EventCode=11
[InterfaceType] Filter for specific interface categories (e.g., WiFi, Bluetooth, 4G).
[FileSizeThreshold] Tunable for environment-specific large file access events pre-transfer.
[TimeWindow] Temporal correlation window for file read followed by network activity.
AN0213 Analytic 0213
Linux

Use of `rfkill`, `nmcli`, or low-level tools (e.g., `iw`, `hcitool`, `pppd`) to enable alternate interfaces followed by data transfer via non-primary NICs.

auditd:SYSCALL None NSM:Flow None
[CommandPattern] Match known interface manipulation utilities or driver invocations.
[NetworkDevice] Tunable to non-default or rarely used interfaces (e.g., wlan1, hci0).
AN0214 Analytic 0214
macOS

AppleScript or system calls to activate WiFi/Bluetooth interfaces (`networksetup`, `blueutil`), followed by exfiltration via AirDrop, cloud sync, or network socket.

macos:unifiedlog None macos:osquery process_events macos:osquery interface_details
[Protocol] Protocol used for exfil (e.g., AirDrop, mDNS, Apple File Service).
[InterfaceActivityWindow] Time period between interface activation and transfer.

Detected Techniques

1

Details

MITRE ID
DET0077
STIX ID
x-mitre-detection-strategy--9280a84d-bf77-4a86-a052-ce6ea0d50e72
Analytics
3
Techniques Detected
1
By Tactic
Exfiltration
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.