Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for THREAT-USBTethering-NetworkBypassExfil.
Upgrade to ProDetect Data Exfiltration via USB Cellular Modem / Mobile Hotspot Tethering (Corporate Network Bypass) in Splunk
Exfiltration Over Other Network Medium (T1011) covers cases where an adversary routes data over a network channel other than the compromised host's primary, monitored corporate connection. One of the most practical instances of this on modern managed endpoints is USB cellular-modem or mobile-hotspot tethering: an operator (insider or malware with local/physical access) plugs an Android device configured for USB tethering, or an iPhone in Personal Hotspot mode, into a corporate workstation. Windows enumerates the phone as a USB RNDIS (Remote NDIS) network adapter and installs it automatically using an in-box driver (usbrndis6.inf or wceusbsh.inf for Windows Mobile Device Center-class devices), creating a second, fully-routable network path that bypasses the corporate proxy, DLP egress inspection, and firewall egress rules entirely — traffic over the tethered adapter never touches the monitored network segment. This is distinct from Bluetooth-based exfiltration (T1011.001, covered separately in this corpus), which uses a fundamentally different protocol stack and driver class, and distinct from T1052.001 (Exfiltration over USB), which covers copying data to USB mass-storage rather than using USB as a network transport. Because RNDIS tethering devices install via Windows' standard Plug and Play driver framework, their arrival is reliably observable in the registry even when process-level or network-flow visibility into the tethered link itself is unavailable (the OS routes traffic over the new adapter, which most EDR network sensors do not separately attribute).
MITRE ATT&CK
- Tactic
- Exfiltration
SPL Detection Query
| union
[search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13)
(TargetObject="*{4d36e972-e325-11ce-bfc1-08002be10318}*"
OR Details="*RNDIS*" OR Details="*Apple Mobile Device*" OR Details="*Android Bootloader Interface*"
OR Details="*usbrndis6.inf*" OR Details="*Remote NDIS*")
| eval DetectionType="RNDIS Tethering Device Installed"
| table _time, host, User, TargetObject, Details, Image, DetectionType]
[search index=sysmon OR index=edr EventCode=3
| eval TetheredSubnetMatch=if(cidrmatch("192.168.42.0/24",SourceIp) OR cidrmatch("192.168.43.0/24",SourceIp) OR cidrmatch("172.20.10.0/28",SourceIp) OR cidrmatch("192.168.42.0/24",DestinationIp) OR cidrmatch("192.168.43.0/24",DestinationIp) OR cidrmatch("172.20.10.0/28",DestinationIp), 1, 0)
| where TetheredSubnetMatch=1
| eval DetectionType="Traffic Over Known Tethered-Subnet IP"
| table _time, host, User, SourceIp, DestinationIp, Image, DetectionType]
| sort - _timeSplunk detection combining Sysmon Event ID 12/13 (Registry Object Added/Deleted, Registry Value Set) matches against the Windows Network adapter class GUID or known mobile-tethering driver/vendor strings, unioned with Sysmon Event ID 3 (Network Connection) matches against the RFC1918 subnets Android and iOS assign by default to a USB/hotspot tethered interface.
Data Sources
Required Sourcetypes
False Positives & Tuning
- IT-approved break-glass internet failover using an employee's personal phone as a tethered hotspot during an outage
- Field/remote workers legitimately tethering where no wired or WiFi corporate network is available and policy permits it
- Developers debugging Android/iOS applications over USB (adb/Xcode) that incidentally installs an RNDIS interface
Other platforms for THREAT-USBTethering-NetworkBypassExfil
Testing Methodology
Validate this detection against 2 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulated RNDIS Network Adapter Class Registry Write
Expected signal: Sysmon Event ID 13 (Registry Value Set) / DeviceRegistryEvents: a value write under the test key with data containing 'Remote NDIS', 'Android Bootloader Interface', and 'usbrndis6.inf'.
- Test 2Simulated Traffic Over a Tethered-Subnet IP Range
Expected signal: Sysmon Event ID 3 (Network Connection) / DeviceNetworkEvents: an outbound connection with LocalIP/SourceIp of 192.168.42.100, matching the Android default USB-tethering NAT subnet.
Unlock playbooks & atomic tests with Pro
Get the full detection package for THREAT-USBTethering-NetworkBypassExfil — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month