Detection of Bluetooth-Based Data Exfiltration

ID: DET0554
Domains: Enterprise
Analytics: AN1531, AN1532, AN1533
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1531

Detection of non-interactive or suspicious processes accessing Bluetooth interfaces and transmitting outbound traffic following file access or staging activity.

Log Sources
Data Component Name Channel
Network Connection Creation (DC0082) WinEventLog:System EventCode=8001
File Creation (DC0039) WinEventLog:Sysmon EventCode=11
Process Creation (DC0032) WinEventLog:Sysmon EventCode=1
Mutable Elements
Field Description
TimeWindow Defines how quickly a file access and Bluetooth activity must occur to be correlated.
InterfaceType May focus on Bluetooth-specific interfaces or drivers like 'bthport.sys'.
FileSizeThreshold Tune to trigger only on significant exfiltratable file reads.

AN1532

Use of hcitool, bluetoothctl, or rfcomm to initialize Bluetooth connection paired with recent file reads by the same user or session.

Log Sources
Data Component Name Channel
Command Execution (DC0064) auditd:SYSCALL None
Network Connection Creation (DC0082) linux:syslog None
File Access (DC0055) linux:osquery None
Mutable Elements
Field Description
BluetoothUtility List of CLI tools to monitor (e.g., hcitool, rfcomm, obexftp).
SessionWindow Amount of time after interface config a file must be accessed to be linked.

AN1533

Observation of blueutil/networksetup commands or low-level APIs toggling Bluetooth or initiating transfers, especially if paired with recent large file read activity by non-GUI processes.

Log Sources
Data Component Name Channel
Command Execution (DC0064) macos:unifiedlog None
Network Connection Creation (DC0082) macos:osquery None
File Access (DC0055) macos:osquery None
Mutable Elements
Field Description
ProcessContext Limit to background processes or scripts with no GUI interaction.
PayloadType Focus on specific sensitive file types (e.g., zip, docx, keychain db).