Skip to content
Every technique
T1011.001No distinct observable

Exfiltration Over Bluetooth

ExfiltrationLinux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

AN1531 (the only Windows analytic in this brief) targets non-interactive or suspicious processes moving data over Bluetooth following file staging. Of its three log sources, System EventID 8001 is a Microsoft-Windows-WLAN-AutoConfig (wireless association) event, not a Bluetooth event at all -- MITRE's mapping mis-scaffolds it here, so no selector against it would ever fire. Sysmon EventID 11 records file creation on the host, i.e. the receiving side of a transfer, not the exfiltrating one. That leaves Sysmon EventID 1 process_creation, where the only binary anywhere in this brief that names a specific Bluetooth-transfer process is fsquirt.exe -- the built-in Bluetooth File Transfer Wizard, which is by definition the interactive path a human drives. […]

What the technique is

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.

Read it on attack.mitre.org

What MITRE says you would watch

  • AN1531

    Detection of non-interactive or suspicious processes accessing Bluetooth interfaces and transmitting outbound traffic following file access or staging activity.

  • AN1532

    Use of hcitool, bluetoothctl, or rfcomm to initialize Bluetooth connection paired with recent file reads by the same user or session.

  • AN1533

    Observation of blueutil/networksetup commands or low-level APIs toggling Bluetooth or initiating transfers, especially if paired with recent large file read activity by non-GUI processes.

Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.