Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0554 — Detection of Bluetooth-Based Data Exfiltration
DET0554

Detection of Bluetooth-Based Data Exfiltration

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN1531 Analytic 1531
Windows

Detection of non-interactive or suspicious processes accessing Bluetooth interfaces and transmitting outbound traffic following file access or staging activity.

WinEventLog:System EventCode=8001 WinEventLog:Sysmon EventCode=11 WinEventLog:Sysmon EventCode=1
[TimeWindow] Defines how quickly a file access and Bluetooth activity must occur to be correlated.
[InterfaceType] May focus on Bluetooth-specific interfaces or drivers like 'bthport.sys'.
[FileSizeThreshold] Tune to trigger only on significant exfiltratable file reads.
AN1532 Analytic 1532
Linux

Use of hcitool, bluetoothctl, or rfcomm to initialize Bluetooth connection paired with recent file reads by the same user or session.

auditd:SYSCALL None linux:syslog None linux:osquery None
[BluetoothUtility] List of CLI tools to monitor (e.g., hcitool, rfcomm, obexftp).
[SessionWindow] Amount of time after interface config a file must be accessed to be linked.
AN1533 Analytic 1533
macOS

Observation of `blueutil`/`networksetup` commands or low-level APIs toggling Bluetooth or initiating transfers, especially if paired with recent large file read activity by non-GUI processes.

macos:unifiedlog None macos:osquery None macos:osquery None
[ProcessContext] Limit to background processes or scripts with no GUI interaction.
[PayloadType] Focus on specific sensitive file types (e.g., zip, docx, keychain db).

Detected Techniques

1

Details

MITRE ID
DET0554
STIX ID
x-mitre-detection-strategy--267a6c25-8d34-47ae-8357-9ae173adaa13
Analytics
3
Techniques Detected
1
By Tactic
Exfiltration
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.