// MITRE ATT&CK
T1011.001 · Exfiltration Over Bluetooth
Sub-técnica de T1011 · Exfiltration Over Other Network Medium.
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have s...
¿Cómo detectarlo y mitigarlo?
La detección de Exfiltration Over Bluetooth parte de la telemetría de tu SIEM/EDR. Escribe una regla de detección con el generador Sigma, analiza logs sospechosos en el analizador de logs y sitúa la técnica en tu cobertura con la matriz ATT&CK.
Técnicas relacionadas
T1567
Exfiltration Over Web Service T1567.004
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication T1567.001
Exfiltration to Code Repository
Exfiltration Over Web Service T1567.004
Exfiltration Over Webhook T1029
Scheduled Transfer T1011
Exfiltration Over Other Network Medium T1020
Automated Exfiltration T1048.001
Exfiltration Over Symmetric Encrypted Non-C2 Protocol T1020.001
Traffic Duplication T1567.001
Exfiltration to Code Repository
Fuente: MITRE ATT&CK®. ATT&CK es una marca registrada de The MITRE Corporation. Contenido con fines educativos.