Detect Exfiltration Over Bluetooth in Microsoft Sentinel
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network. Real-world examples include the Flame malware's BeetleJuice module, which transmitted encoded data over Bluetooth and acted as a Bluetooth beacon to identify nearby Bluetooth-enabled devices.
MITRE ATT&CK
- Tactic
- Exfiltration
- Sub-technique
- T1011.001 Exfiltration Over Bluetooth
- Canonical reference
- https://attack.mitre.org/techniques/T1011/001/
KQL Detection Query
let BluetoothTools = dynamic([
"btattach", "btmgmt", "hciconfig", "hcitool", "hcidump", "bluetoothctl",
"sdptool", "rfcomm", "obexftp", "obexd", "bluetooth-sendto",
"fsquirt", "btvstack", "fsquirt.exe"
]);
let BluetoothCmdPatterns = dynamic([
"bluetooth", "rfcomm", "obex", "btooth", "hci", "btspp",
"00:00:00", "bt-adapter", "bluetoothd"
]);
let SuspiciousParents = dynamic([
"python.exe", "python3", "perl", "ruby", "bash", "sh", "cmd.exe",
"powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe"
]);
// Detect Bluetooth utility process launches
let BluetoothProcesses = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName has_any (BluetoothTools)
or ProcessCommandLine has_any (BluetoothCmdPatterns)
| extend DetectionType = "Bluetooth Tool Execution"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Detect Bluetooth-related registry changes on Windows (Bluetooth adapter enable/disable or pairing)
let BluetoothRegistry = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has_any ("Bluetooth", "BTHPORT", "BTHENUM", "BthLE", "RFCOMM", "OBEX")
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated")
| extend DetectionType = "Bluetooth Registry Modification"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
FileName = InitiatingProcessFileName,
ProcessCommandLine = InitiatingProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Detect file operations targeting Bluetooth stack or suspicious staging near Bluetooth access
let BluetoothFiles = DeviceFileEvents
| where Timestamp > ago(24h)
| where (FolderPath has_any ("bluetooth", "btooth", "rfcomm", "obex"))
or (FileName has_any ("bluetooth", "rfcomm", "obex") and ActionType == "FileCreated")
| extend DetectionType = "Bluetooth-Related File Activity"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
FileName = InitiatingProcessFileName,
ProcessCommandLine = InitiatingProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, DetectionType;
// Union all detection types
BluetoothProcesses
| union BluetoothRegistry
| union BluetoothFiles
| sort by Timestamp descDetects potential Bluetooth-based exfiltration activity across Windows, Linux, and macOS endpoints monitored by Microsoft Defender for Endpoint. Monitors for execution of known Bluetooth utilities (hciconfig, hcitool, rfcomm, obexftp, fsquirt), Bluetooth-related registry modifications (adapter configuration, pairing keys, BTHPORT driver), and file system activity in Bluetooth-related paths. The detection is multi-layered because Bluetooth exfiltration typically leaves process execution, registry, or file artifacts depending on the operating system and method used.
Data Sources
Required Tables
False Positives & Tuning
- IT administrators using Bluetooth utilities for device pairing, diagnostics, or inventory on managed endpoints
- Developers building Bluetooth applications testing functionality on their workstations
- Windows built-in Bluetooth file transfer wizard (fsquirt.exe) used by employees for legitimate personal file transfers between devices
- Bluetooth speakers, headsets, or peripherals being managed via system utilities on user workstations
Other platforms for T1011.001
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enumerate Bluetooth Devices on Windows
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe and CommandLine containing 'Get-PnpDevice' and 'Bluetooth'. PowerShell ScriptBlock Log Event ID 4104 with the full enumeration command. No registry modification events, but PnpDevice queries may appear in Windows Plug and Play logs.
- Test 2Linux Bluetooth Device Scan with hcitool
Expected signal: Linux auditd: execve syscall for hcitool with arguments 'scan' and 'lescan'. Syslog/daemon.log: bluetoothd activity logs showing scan initiation. If auditd is configured with execve monitoring: type=EXECVE msg= records with a0='hcitool' a1='scan'. Sysmon for Linux Event ID 1 if deployed.
- Test 3Transfer File via OBEX over Bluetooth on Linux
Expected signal: Linux auditd/Sysmon: execve event for obexftp with arguments including '--bluetooth', a MAC address, and '--put' with the file path. File creation event for /tmp/bt_test_exfil.txt. The process will exit with an error but telemetry is generated. Syslog may show bluetoothd connection attempt to the specified MAC address.
- Test 4Python Bluetooth Exfiltration Script Execution (Windows/Linux)
Expected signal: Sysmon Event ID 1: Process Create for python3.exe or python.exe with CommandLine referencing Bluetooth. Child process creation: powershell.exe spawned by python with 'Get-PnpDevice -Class Bluetooth'. Sysmon Event ID 1 for the child powershell.exe. PowerShell ScriptBlock Log Event ID 4104 for the enumeration command.
- Test 5Bluetooth Registry Key Inspection for Paired Devices
Expected signal: Sysmon Event ID 1: Process Create for reg.exe with query arguments targeting BTHPORT. If PowerShell fallback executes: Sysmon Event ID 1 for powershell.exe with BTHPORT in CommandLine. Sysmon Event ID 12 (Registry key access) for HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices. PowerShell ScriptBlock Log Event ID 4104.
References (10)
- https://attack.mitre.org/techniques/T1011/001/
- https://attack.mitre.org/software/S0143/
- https://securelist.com/the-flame-questions-and-answers/34344/
- https://docs.microsoft.com/en-us/windows-hardware/drivers/bluetooth/bluetooth-host-radio-support
- https://www.bluetooth.com/learn-about-bluetooth/tech-overview/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1011.001/T1011.001.md
- https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/interactive-logon-do-not-require-ctrl-alt-del
- https://www.stigviewer.com/stig/windows_10/2021-08-18/finding/V-220843
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceregistryevents-table
- https://www.sans.org/white-papers/bluetooth-security-overview/
Unlock Pro Content
Get the full detection package for T1011.001 including response playbook, investigation guide, and atomic red team tests.