AN0212
Analytic 0212
Windows
Execution of file transfer or network access activity through non-primary interfaces (e.g., WiFi, Bluetooth, cellular) by processes not typically associated with such behavior (e.g., rundll32, powershell, regsvr32).
WinEventLog:Sysmon
EventCode=3, 22
WinEventLog:System
EventCode=5005 (WLAN), EventCode=302 (Bluetooth)
WinEventLog:Sysmon
EventCode=11
[InterfaceType]
Filter for specific interface categories (e.g., WiFi, Bluetooth, 4G).
[FileSizeThreshold]
Tunable for environment-specific large file access events pre-transfer.
[TimeWindow]
Temporal correlation window for file read followed by network activity.
AN0213
Analytic 0213
Linux
Use of `rfkill`, `nmcli`, or low-level tools (e.g., `iw`, `hcitool`, `pppd`) to enable alternate interfaces followed by data transfer via non-primary NICs.
auditd:SYSCALL
None
NSM:Flow
None
[CommandPattern]
Match known interface manipulation utilities or driver invocations.
[NetworkDevice]
Tunable to non-default or rarely used interfaces (e.g., wlan1, hci0).
AN0214
Analytic 0214
macOS
AppleScript or system calls to activate WiFi/Bluetooth interfaces (`networksetup`, `blueutil`), followed by exfiltration via AirDrop, cloud sync, or network socket.
macos:unifiedlog
None
macos:osquery
process_events
macos:osquery
interface_details
[Protocol]
Protocol used for exfil (e.g., AirDrop, mDNS, Apple File Service).
[InterfaceActivityWindow]
Time period between interface activation and transfer.