---
{
  "title": "Exfiltration Over Other Network Medium",
  "summary": "Exfiltration over another network medium uses a path different from the primary managed network.",
  "topic": "networking",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    2
  ],
  "aliases": [
    "T1011"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1011: Exfiltration Over Other Network Medium",
      "url": "https://attack.mitre.org/techniques/T1011"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Exfiltration over another network medium uses a path different from the primary managed network. Wireless or other connectivity may leave gaps in the expected network record.


## An investigation example

A laptop with suspicious collection artifacts transfers data while connected through an unexpected secondary interface.

## Evidence to examine

Examine interface changes, host network events, device configuration, and collected data timing alongside gateway logs.

## A common analytical pitfall

Absence of a transfer in the corporate gateway logs does not establish that no other communication path existed.

## Response considerations

Identify alternate connectivity, preserve host evidence, and apply containment that accounts for the actual interfaces in use.


## The monitored network may not be the only route

A device can have more than one communication medium, such as wired networking, wireless connectivity, or another available interface. An intruder may move information through a route different from the one defenders expect to monitor. A quiet corporate gateway therefore does not necessarily exclude every possible network export path.

Multiple interfaces are also normal in laptops and mobile workflows. Assess which interface was active, what routes and permissions applied, which process initiated communication, and whether the use was authorized. The presence of an interface does not prove it carried sensitive information during the incident. Configuration and actual traffic need separate evidence.

## A fictional alternate-interface transfer

An academy investigates a workstation whose corporate network records show little outbound activity, while endpoint events suggest an upload. Analysts examine interface state, connection records, and relevant device-management information. They consider whether the traffic used another approved or unapproved route without assuming that one unexplained gap proves the hypothesis.

Visibility can differ significantly across media. Some sources may retain only association or connection metadata, while others provide process-level detail. Record those limitations and avoid claiming exact payload content from a route observation alone. Sensitive personal-device or location information should remain within the authorized investigative scope.

## Map all intended paths

Draw a fictional laptop with wired, Wi-Fi, and a separate connectivity option. Mark which routes are approved for business data and where evidence exists. Then identify the records needed to establish that a particular transfer used one path. A paper exercise is sufficient; do not connect real restricted data to an unapproved network.

Defensive planning should align network policy, endpoint controls, and data handling with legitimate mobility needs. Disabling one interface without understanding dependencies can disrupt operations while leaving another route available. A proportionate response identifies the observed path and the access that enabled the transfer, then verifies that the intended boundary is restored.

## Related concepts

- [[packet-analysis]]
- [[exfiltration]]
- [[network-segmentation]]