Exfiltration Over Bluetooth
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
AN1531 (the only Windows analytic in this brief) targets non-interactive or suspicious processes moving data over Bluetooth following file staging. Of its three log sources, System EventID 8001 is a Microsoft-Windows-WLAN-AutoConfig (wireless association) event, not a Bluetooth event at all -- MITRE's mapping mis-scaffolds it here, so no selector against it would ever fire. Sysmon EventID 11 records file creation on the host, i.e. the receiving side of a transfer, not the exfiltrating one. That leaves Sysmon EventID 1 process_creation, where the only binary anywhere in this brief that names a specific Bluetooth-transfer process is fsquirt.exe -- the built-in Bluetooth File Transfer Wizard, which is by definition the interactive path a human drives. […]
What the technique is
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1531
Detection of non-interactive or suspicious processes accessing Bluetooth interfaces and transmitting outbound traffic following file access or staging activity.
- AN1532
Use of hcitool, bluetoothctl, or rfcomm to initialize Bluetooth connection paired with recent file reads by the same user or session.
- AN1533
Observation of blueutil/networksetup commands or low-level APIs toggling Bluetooth or initiating transfers, especially if paired with recent large file read activity by non-GUI processes.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.