MITRE ATT&CK Enterprise
T1011.001
enhancement

Exfiltration Over Bluetooth

Parent: T1011

Description

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.

Mapped SPARTA techniques

No techniques mapped to this control.

Cite as SafeMode Space, mitre-attack-enterprise T1011.001.

Built 2026-07-25 from 216 techniques, 334 regulation articles, 125 ENISA controls, 2,610 framework controls, and 90 countermeasures.