AN1531
Analytic 1531
Windows
Detection of non-interactive or suspicious processes accessing Bluetooth interfaces and transmitting outbound traffic following file access or staging activity.
WinEventLog:System
EventCode=8001
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
[TimeWindow]
Defines how quickly a file access and Bluetooth activity must occur to be correlated.
[InterfaceType]
May focus on Bluetooth-specific interfaces or drivers like 'bthport.sys'.
[FileSizeThreshold]
Tune to trigger only on significant exfiltratable file reads.
AN1532
Analytic 1532
Linux
Use of hcitool, bluetoothctl, or rfcomm to initialize Bluetooth connection paired with recent file reads by the same user or session.
auditd:SYSCALL
None
linux:syslog
None
linux:osquery
None
[BluetoothUtility]
List of CLI tools to monitor (e.g., hcitool, rfcomm, obexftp).
[SessionWindow]
Amount of time after interface config a file must be accessed to be linked.
AN1533
Analytic 1533
macOS
Observation of `blueutil`/`networksetup` commands or low-level APIs toggling Bluetooth or initiating transfers, especially if paired with recent large file read activity by non-GUI processes.
macos:unifiedlog
None
macos:osquery
None
macos:osquery
None
[ProcessContext]
Limit to background processes or scripts with no GUI interaction.
[PayloadType]
Focus on specific sensitive file types (e.g., zip, docx, keychain db).