通过其他网络介质渗出是指攻击者利用非标准网络通道（如蓝牙、射频信号、物理连接等）传输窃取数据的技术手段。与常规网络渗出不同，该技术规避企业网络安全边界防护，利用辅助通信接口或物理层媒介建立隐蔽传输通道。防御措施主要包括监控非常规网络接口的异常活动、分析设备驱动程序行为异常，以及检测未授权无线电信号发射等。
为突破传统网络边界防御体系，攻击者不断演进渗出技术形态，通过硬件层信号调制、协议栈寄生劫持、电磁环境融合等手段，将渗出行为深度隐匿于设备正常运行产生的物理效应或业务交互中，形成"无协议特征、无网络痕迹"的新型数据窃取范式。
现有渗出匿迹技术的核心逻辑聚焦于攻击媒介的物理层重构与业务上下文融合。攻击者通过协议逆向消除技术指纹，利用硬件固有特性实现信号寄生，并深度耦合目标场景的业务逻辑：短距无线通信渗出通过精确仿冒协议交互流程，使恶意流量在协议解析层面不可区分；低频射频渗出将数据编码为设备运行的自然电磁辐射，规避传统网络监控范围；IoT流量寄生渗出则完全复用设备制造商定义的通信模型，使渗出行为获得业务合理性背书。三类技术的共性在于突破传统以网络流量为检测对象的防御范式，通过物理层、协议层、业务层的多维隐匿设计，使渗出行为在多个检测维度均呈现合法特征。
匿迹技术的发展导致传统基于网络流量分析和协议特征检测的防御体系出现能力盲区，防御方需构建涵盖电磁信号监测、设备固件完整性校验、异构协议深度解析的综合检测能力，并引入物理层行为基线建模、硬件指纹异常检测等新型防护手段。
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ✅ |
| 数据遮蔽 | ✅ |
| 时空释痕 | ✅ |
攻击者通过精确复现合法设备的通信协议结构和交互时序，将渗出流量伪装成IoT设备状态上报、固件更新请求等正常业务交互。例如在蓝牙渗出中严格遵循GATT协议规范，在射频渗出中模拟设备电磁辐射特征，使得渗出行为在协议解析和信号分析层面均呈现合法特征。
利用零日漏洞获取设备底层硬件控制权，通过驱动级代码注入实现渗出通道构建，传统基于应用层行为监控的防御机制无法感知固件层的恶意操作，使得渗出过程对防御方完全透明。
在射频信号渗出中采用混沌加密算法对数据进行混淆，同时利用物理层信号调制技术将数字信息转换为模拟电磁波变化，使得渗出内容无法通过常规网络解密手段还原。
通过分时复用多个硬件组件的辐射特性，将完整数据集分割为微秒级信号片段，结合设备正常工作产生的电磁噪声背景，使渗出信号特征在时间维度被稀释，传统基于持续信号检测的射频监控难以有效捕获。
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
Disable WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel in local computer security settings or by group policy if it is not needed within an environment. |
| M1028 | Operating System Configuration |
Prevent the creation of new network adapters where possible.[1][2] |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments that may attempt to exfiltrate data over a different network medium than the command and control channel |
| DS0022 | File | File Access |
Monitor for files being accessed that could be related to exfiltration, such as file reads by a process that also has an active network connection. |
| DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections that may attempt to exfiltrate data over a different network medium than the command and control channel. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Note: Network Analysis frameworks such as Zeek can be used to capture, decode, and alert on TCP network connection creation. The below analytic is using an event ID from OSQuery. |
| Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |
||
| Network Traffic Flow |
Monitor network data for uncommon data flows., such as the usage of abnormal/unexpected protocols. |