Exfiltration Over Other Network Medium

let WirelessHotspotPatterns = dynamic([
  "hostednetwork", "start hostednetwork", "mode=allow", "mode=disallow",
  "mobile hotspot", "set hostednetwork"
]);
let WirelessDiscoveryPatterns = dynamic([
  "show interface", "show networks", "show profiles",
  "show wlanreport", "show hostednetwork", "show drivers"
]);
let BluetoothTransferBinaries = dynamic([
  "fsquirt.exe", "bttray.exe"
]);
let SuspiciousParents = dynamic([
  "cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe",
  "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe"
]);
// Branch 1: netsh wlan commands for hotspot creation or wireless interface manipulation
let NetshWlanBranch = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine has "wlan" or ProcessCommandLine has_any (WirelessHotspotPatterns)
| extend DetectionBranch = "NetshWlanConfig"
| extend IsHotspotCreation = ProcessCommandLine has_any (["hostednetwork", "mode=allow", "start hostednetwork"])
| extend IsWirelessDiscovery = ProcessCommandLine has_any (WirelessDiscoveryPatterns);
// Branch 2: Bluetooth file transfer wizard and tray utilities
let BluetoothTransferBranch = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (BluetoothTransferBinaries)
| extend DetectionBranch = "BluetoothFileTransfer"
| extend IsHotspotCreation = false
| extend IsWirelessDiscovery = false;
// Branch 3: PowerShell manipulating wireless or Bluetooth adapters — higher-fidelity if spawned from suspicious parent
let PSWirelessBranch = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ([
    "Bluetooth", "WiFi", "WLAN", "MobileBroadband",
    "NetAdapter", "New-WiFiProfile", "Get-NetAdapter",
    "Set-NetConnectionProfile", "Add-VpnConnection",
    "SoftAP", "HostedNetwork"
  ])
| where InitiatingProcessFileName has_any (SuspiciousParents)
    or ProcessCommandLine has_any (["-enc", "-EncodedCommand", "Compress-Archive", "DownloadFile", "exfil"])
| extend DetectionBranch = "PSWirelessManipulation"
| extend IsHotspotCreation = ProcessCommandLine has_any (["HostedNetwork", "SoftAP", "hotspot"])
| extend IsWirelessDiscovery = ProcessCommandLine has_any (["Get-NetAdapter", "Get-WiFiProfile", "show"]);
union NetshWlanBranch, BluetoothTransferBranch, PSWirelessBranch
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         DetectionBranch, IsHotspotCreation, IsWirelessDiscovery
| sort by Timestamp desc

index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 OR sourcetype="WinEventLog:Security" EventCode=4688)
| eval Image=coalesce(Image, NewProcessName)
| eval CommandLine=coalesce(CommandLine, ProcessCommandLine)
| eval ParentImage=coalesce(ParentImage, ParentProcessName)
| eval Image_lc=lower(Image)
| eval CmdLine_lc=lower(CommandLine)
| eval IsNetshWlan=if(match(Image_lc, "netsh\.exe") AND (match(CmdLine_lc, "wlan") OR match(CmdLine_lc, "hostednetwork") OR match(CmdLine_lc, "mobile\s*hotspot")), 1, 0)
| eval IsBluetoothTool=if(match(Image_lc, "(fsquirt\.exe|bttray\.exe)"), 1, 0)
| eval IsPSWirelessManip=if(match(Image_lc, "(powershell\.exe|pwsh\.exe)") AND match(CmdLine_lc, "(bluetooth|wlan|wifi|netadapter|get-netadapter|new-wifiprofile|mobilebroadband|set-netconnectionprofile|softap|hostednetwork)"), 1, 0)
| eval IsHotspotCreation=if(match(CmdLine_lc, "(hostednetwork|start\s+hostednetwork|mode=allow|softap)"), 1, 0)
| eval SuspicionScore=IsNetshWlan + IsBluetoothTool + IsPSWirelessManip + IsHotspotCreation
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, IsNetshWlan, IsBluetoothTool, IsPSWirelessManip, IsHotspotCreation, SuspicionScore
| sort - _time

process where event.type == "start" and
(
  (
    process.name : "netsh.exe" and
    process.command_line : ("*wlan*", "*hostednetwork*", "*mode=allow*", "*mode=disallow*", "*mobile hotspot*", "*set hostednetwork*", "*start hostednetwork*")
  ) or
  process.name : ("fsquirt.exe", "bttray.exe") or
  (
    process.name : ("powershell.exe", "pwsh.exe") and
    process.command_line : ("*Bluetooth*", "*WiFi*", "*WLAN*", "*HostedNetwork*", "*SoftAP*", "*NetAdapter*", "*MobileBroadband*", "*New-WiFiProfile*", "*Get-NetAdapter*", "*Set-NetConnectionProfile*") and
    (
      process.parent.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe", "regsvr32.exe", "schtasks.exe") or
      process.command_line : ("*-enc*", "*-EncodedCommand*", "*Compress-Archive*", "*DownloadFile*", "*exfil*")
    )
  )
)

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LOGSOURCENAME(logsourceid) AS LogSource,
  username,
  filename AS ProcessName,
  "Command" AS CommandLine,
  "Parent Process Path" AS ParentProcess,
  CASE
    WHEN LOWER(filename) LIKE '%netsh.exe%'
      AND (LOWER("Command") LIKE '%wlan%'
        OR LOWER("Command") LIKE '%hostednetwork%'
        OR LOWER("Command") LIKE '%mode=allow%'
        OR LOWER("Command") LIKE '%mode=disallow%'
        OR LOWER("Command") LIKE '%mobile hotspot%')
      THEN 'NetshWlanConfig'
    WHEN LOWER(filename) LIKE '%fsquirt.exe%'
      OR LOWER(filename) LIKE '%bttray.exe%'
      THEN 'BluetoothFileTransfer'
    WHEN (LOWER(filename) LIKE '%powershell.exe%' OR LOWER(filename) LIKE '%pwsh.exe%')
      AND (LOWER("Command") LIKE '%bluetooth%'
        OR LOWER("Command") LIKE '%wlan%'
        OR LOWER("Command") LIKE '%wifi%'
        OR LOWER("Command") LIKE '%hostednetwork%'
        OR LOWER("Command") LIKE '%softap%'
        OR LOWER("Command") LIKE '%netadapter%'
        OR LOWER("Command") LIKE '%mobilebroadband%')
      THEN 'PSWirelessManipulation'
    ELSE 'Unknown'
  END AS DetectionBranch,
  CASE
    WHEN LOWER("Command") LIKE '%hostednetwork%'
      OR LOWER("Command") LIKE '%mode=allow%'
      OR LOWER("Command") LIKE '%softap%'
    THEN TRUE ELSE FALSE
  END AS IsHotspotCreation
FROM events
WHERE
  LOGSOURCETYPEID IN (12, 382)
  AND (
    (
      LOWER(filename) LIKE '%netsh.exe%' AND (
        LOWER("Command") LIKE '%wlan%' OR
        LOWER("Command") LIKE '%hostednetwork%' OR
        LOWER("Command") LIKE '%mode=allow%' OR
        LOWER("Command") LIKE '%mode=disallow%' OR
        LOWER("Command") LIKE '%mobile hotspot%'
      )
    ) OR
    LOWER(filename) LIKE '%fsquirt.exe%' OR
    LOWER(filename) LIKE '%bttray.exe%' OR
    (
      (LOWER(filename) LIKE '%powershell.exe%' OR LOWER(filename) LIKE '%pwsh.exe%')
      AND (
        LOWER("Command") LIKE '%bluetooth%' OR
        LOWER("Command") LIKE '%wlan%' OR
        LOWER("Command") LIKE '%wifi%' OR
        LOWER("Command") LIKE '%hostednetwork%' OR
        LOWER("Command") LIKE '%softap%' OR
        LOWER("Command") LIKE '%netadapter%' OR
        LOWER("Command") LIKE '%mobilebroadband%'
      )
    )
  )
  AND starttime > NOW() - 86400 SECONDS
ORDER BY starttime DESC
LIMIT 500

(_sourceCategory=*Windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*winlogbeat*)
| where EventID = 1 OR EventID = 4688
| eval image_lc = toLowerCase(Image)
| eval cmdline_lc = toLowerCase(CommandLine)
| where (
    image_lc matches /netsh\.exe/ AND (
      cmdline_lc contains "wlan" OR
      cmdline_lc contains "hostednetwork" OR
      cmdline_lc contains "mode=allow" OR
      cmdline_lc contains "mode=disallow" OR
      cmdline_lc contains "mobile hotspot"
    )
  )
  OR image_lc matches /fsquirt\.exe|bttray\.exe/
  OR (
    image_lc matches /powershell\.exe|pwsh\.exe/ AND (
      cmdline_lc contains "bluetooth" OR
      cmdline_lc contains "wlan" OR
      cmdline_lc contains "wifi" OR
      cmdline_lc contains "hostednetwork" OR
      cmdline_lc contains "softap" OR
      cmdline_lc contains "netadapter" OR
      cmdline_lc contains "mobilebroadband" OR
      cmdline_lc contains "new-wifiprofile" OR
      cmdline_lc contains "get-netadapter" OR
      cmdline_lc contains "set-netconnectionprofile"
    )
  )
| eval DetectionBranch = if(image_lc matches /netsh\.exe/, "NetshWlanConfig",
    if(image_lc matches /fsquirt\.exe|bttray\.exe/, "BluetoothFileTransfer",
       "PSWirelessManipulation"))
| eval IsHotspotCreation = if(
    cmdline_lc contains "hostednetwork" OR
    cmdline_lc contains "mode=allow" OR
    cmdline_lc contains "softap",
    "true", "false")
| eval IsWirelessDiscovery = if(
    cmdline_lc contains "show interface" OR
    cmdline_lc contains "show networks" OR
    cmdline_lc contains "show profiles" OR
    cmdline_lc contains "show hostednetwork" OR
    cmdline_lc contains "get-netadapter",
    "true", "false")
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, DetectionBranch, IsHotspotCreation, IsWirelessDiscovery
| sort by _messageTime desc

rule t1011_exfil_other_network_medium {
  meta:
    author = "Detection Engineering"
    description = "Detects T1011 - Exfiltration Over Other Network Medium via wireless hotspot creation, Bluetooth file transfer utilities, or PowerShell wireless adapter manipulation from suspicious parent processes"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1011"
    severity = "HIGH"
    priority = "HIGH"
    false_positives = "IT admin netsh diagnostics, legitimate Bluetooth transfers, MDM or endpoint tooling using wireless PowerShell cmdlets"
    version = "1.0"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      (
        re.regex($e.target.process.file.full_path, `(?i)netsh\.exe$`) and
        (
          re.regex($e.target.process.command_line, `(?i)wlan`) or
          re.regex($e.target.process.command_line, `(?i)hostednetwork`) or
          re.regex($e.target.process.command_line, `(?i)mode=(allow|disallow)`) or
          re.regex($e.target.process.command_line, `(?i)mobile.hotspot`)
        )
      ) or
      re.regex($e.target.process.file.full_path, `(?i)(fsquirt|bttray)\.exe$`) or
      (
        re.regex($e.target.process.file.full_path, `(?i)(powershell|pwsh)\.exe$`) and
        re.regex($e.target.process.command_line, `(?i)(bluetooth|wlan|wifi|netadapter|get-netadapter|new-wifiprofile|hostednetwork|softap|mobilebroadband|set-netconnectionprofile)`) and
        (
          re.regex($e.principal.process.file.full_path, `(?i)(cmd|powershell|wscript|cscript|mshta|rundll32|regsvr32|schtasks)\.exe$`) or
          re.regex($e.target.process.command_line, `(?i)(-enc|-EncodedCommand|Compress-Archive|DownloadFile|exfil)`)
        )
      )
    )

  condition:
    $e
}

#event_simpleName = "ProcessRollup2"
| IsNetshWlan := if(
    FileName = /netsh\.exe/i
    AND CommandLine = /wlan|hostednetwork|mode=allow|mode=disallow|mobile.hotspot/i,
    1, 0)
| IsBluetoothTool := if(
    FileName = /fsquirt\.exe|bttray\.exe/i,
    1, 0)
| IsPSWireless := if(
    FileName = /powershell\.exe|pwsh\.exe/i
    AND CommandLine = /bluetooth|wlan|wifi|netadapter|get-netadapter|new-wifiprofile|hostednetwork|softap|mobilebroadband|set-netconnectionprofile/i
    AND (
      ParentBaseFileName = /cmd\.exe|powershell\.exe|wscript\.exe|cscript\.exe|mshta\.exe|rundll32\.exe|regsvr32\.exe|schtasks\.exe/i
      OR CommandLine = /-enc|-EncodedCommand|Compress-Archive|DownloadFile|exfil/i
    ),
    1, 0)
| SuspicionScore := IsNetshWlan + IsBluetoothTool + IsPSWireless
| SuspicionScore > 0
| DetectionBranch := case {
    IsNetshWlan = 1 : "NetshWlanConfig";
    IsBluetoothTool = 1 : "BluetoothFileTransfer";
    IsPSWireless = 1 : "PSWirelessManipulation";
    * : "Other"
  }
| IsHotspotCreation := if(
    CommandLine = /hostednetwork|mode=allow|softap/i,
    "true", "false")
| IsWirelessDiscovery := if(
    CommandLine = /show.interface|show.networks|show.profiles|show.hostednetwork|get-netadapter/i,
    "true", "false")
| table(
    [timestamp, ComputerName, UserName, FileName, CommandLine,
     ParentBaseFileName, DetectionBranch, IsHotspotCreation,
     IsWirelessDiscovery, SuspicionScore],
    sortby=timestamp, order=desc)