T1011 Splunk · SPL

Detect Exfiltration Over Other Network Medium in Splunk

Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel. If the command and control network is a wired Internet connection, the exfiltration may occur over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel. Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network monitoring infrastructure. This technique is commonly associated with insider threat scenarios and advanced adversaries who have achieved a foothold and seek to bypass perimeter DLP controls that monitor only the primary wired egress channel.

MITRE ATT&CK

Tactic
Exfiltration
Technique
T1011 Exfiltration Over Other Network Medium
Canonical reference
https://attack.mitre.org/techniques/T1011/

SPL Detection Query

Splunk (SPL)
spl 
index=wineventlog (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 OR sourcetype="WinEventLog:Security" EventCode=4688)
| eval Image=coalesce(Image, NewProcessName)
| eval CommandLine=coalesce(CommandLine, ProcessCommandLine)
| eval ParentImage=coalesce(ParentImage, ParentProcessName)
| eval Image_lc=lower(Image)
| eval CmdLine_lc=lower(CommandLine)
| eval IsNetshWlan=if(match(Image_lc, "netsh\.exe") AND (match(CmdLine_lc, "wlan") OR match(CmdLine_lc, "hostednetwork") OR match(CmdLine_lc, "mobile\s*hotspot")), 1, 0)
| eval IsBluetoothTool=if(match(Image_lc, "(fsquirt\.exe|bttray\.exe)"), 1, 0)
| eval IsPSWirelessManip=if(match(Image_lc, "(powershell\.exe|pwsh\.exe)") AND match(CmdLine_lc, "(bluetooth|wlan|wifi|netadapter|get-netadapter|new-wifiprofile|mobilebroadband|set-netconnectionprofile|softap|hostednetwork)"), 1, 0)
| eval IsHotspotCreation=if(match(CmdLine_lc, "(hostednetwork|start\s+hostednetwork|mode=allow|softap)"), 1, 0)
| eval SuspicionScore=IsNetshWlan + IsBluetoothTool + IsPSWirelessManip + IsHotspotCreation
| where SuspicionScore > 0
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, IsNetshWlan, IsBluetoothTool, IsPSWirelessManip, IsHotspotCreation, SuspicionScore
| sort - _time
high severity medium confidence

Detects exfiltration over alternative network mediums using Sysmon Event ID 1 or Security Event ID 4688 (Process Creation). Evaluates process names and command lines for wireless configuration utilities (netsh wlan), Bluetooth file transfer tools (fsquirt.exe, bttray.exe), and PowerShell wireless adapter manipulation. Assigns a cumulative suspicion score across four indicator categories; events scoring 2 or higher should be prioritized for immediate triage. Hotspot creation (IsHotspotCreation=1) combined with any other indicator is a high-confidence exfiltration staging signal.

Data Sources

Process: Process CreationCommand: Command ExecutionSysmon Event ID 1Security Event ID 4688

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/OperationalWinEventLog:Security

False Positives & Tuning

  • IT administrators running netsh wlan commands to diagnose wireless connectivity issues or manage corporate wireless profiles
  • Help desk staff using netsh wlan show commands for network troubleshooting on user endpoints
  • MDM/EMM agents (Microsoft Intune, SCCM/MECM) deploying or updating wireless configuration profiles via PowerShell
  • End users legitimately transferring personal files to Bluetooth peripherals (headphones, phones) via fsquirt.exe
  • Network assessment or inventory tools querying wireless adapter status and available SSIDs

Other platforms for T1011

Microsoft Sentinel (KQL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Create and Start WiFi Hosted Network via netsh

    Expected signal: Sysmon Event ID 1: Two Process Create events — first with CommandLine containing 'wlan set hostednetwork mode=allow ssid=df00tech-test-exfil', second containing 'wlan start hostednetwork'. Security Event ID 4688 if command-line auditing is enabled. Windows WLAN-AutoConfig Operational Event ID 11000 (Microsoft-Windows-WLAN-AutoConfig: The wireless Hosted Network started successfully). Registry change under HKLM\SYSTEM\CurrentControlSet\Services\WlanSvc\Parameters\HostedNetworkSettings.

  2. Test 2 Launch Bluetooth File Transfer Wizard (fsquirt.exe)

    Expected signal: Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\fsquirt.exe, ParentImage=powershell.exe, User=current user. Security Event ID 4688 if command-line auditing is enabled. Bluetooth-Driver Operational log may record adapter activation. No file creation or network connection events since no transfer is completed.

  3. Test 3 Wireless Adapter Reconnaissance via PowerShell and netsh

    Expected signal: Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-NetAdapter' and 'PhysicalMediaType'. Child Sysmon Event ID 1 processes for netsh.exe with CommandLine 'wlan show interfaces' and 'wlan show profiles'. PowerShell ScriptBlock Log Event ID 4104 with the full script content.

  4. Test 4 Linux Bluetooth Device Discovery and OBEX Transfer Preparation

    Expected signal: Linux auditd (if configured with execve rules): SYSCALL records type=EXECVE for hciconfig, hcitool, bluetoothctl, and rfkill with their arguments and auid/uid/pid context. Syslog/journal entries from the Bluetooth daemon (bluetoothd) showing adapter state transitions. If Microsoft Defender for Linux is deployed, DeviceProcessEvents will record these process creation events.

Last updated: 2026-04-13 Research depth: deep
References (5)

Response Playbook

Triage

  1. Identify the exact command executed — was a WiFi hosted network created (netsh wlan set hostednetwork mode=allow / start hostednetwork), was the Bluetooth file transfer wizard opened (fsquirt.exe), or was a wireless adapter being configured programmatically via PowerShell? The specific command determines the exfiltration mechanism.
  2. Review the 30–60 minutes before the wireless tool execution for data staging activity: search DeviceFileEvents or Sysmon Event ID 11 for archive creation (*.zip, *.7z, *.rar), bulk file copies to temp directories, or large files written to user-accessible paths.
  3. Check the user context and whether it is expected — standard users creating WiFi hotspots on corporate endpoints is highly anomalous. Verify against change tickets, helpdesk records, or MDM device policy to confirm legitimacy.
  4. Determine if the hosted network was successfully activated and if any external devices connected — check Windows WLAN-AutoConfig Operational log (Event IDs 11000 for hosted network started, 11004 for device connected to hosted network) and Bluetooth Operational log for pairing events.
  5. For Bluetooth events: identify any Bluetooth devices that appear in the pairing history (HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices) that are not in the authorized device inventory. An unrecognized device is a critical indicator.
  6. If PowerShell was used: decode any encoded commands and check for downstream file operations, network connections (Sysmon Event ID 3), or child process creation immediately following the wireless configuration step.

Containment

  1. Disable all wireless adapters on the endpoint via EDR isolation policy or Group Policy (Computer Configuration > Administrative Templates > Network > Network Connections > Prohibit connection to non-domain networks when connected to a domain network) to prevent continued exfiltration.
  2. If a WiFi hotspot was active: run 'netsh wlan stop hostednetwork' on the endpoint and capture the SSID and passphrase before stopping — the SSID may help identify the receiving device or threat actor infrastructure.
  3. If Bluetooth file transfer was initiated: immediately check the Bluetooth pairing history and note any device MAC addresses paired during the incident window. File a report with physical security if the device was not an authorized peripheral.
  4. Isolate the endpoint from the network using full EDR network isolation if data staging evidence is confirmed — this prevents both continued wireless exfiltration and any in-progress C2 communication.
  5. Disable the affected user account in Active Directory and revoke all active sessions, OAuth tokens, and VPN sessions until the investigation determines whether the activity was insider-driven or the result of external compromise.
  6. Preserve the forensic state before any remediation: collect the full disk image, WLAN event logs, Bluetooth event logs, and Sysmon EVTX files. Wireless exfiltration incidents may involve physical media or nearby devices that require law enforcement coordination.

Evidence Collection

  1. Windows WLAN-AutoConfig Operational Log: Event Viewer > Applications and Services Logs > Microsoft > Windows > WLAN-AutoConfig > Operational — Event IDs 8001 (connected), 8003 (disconnected), 11000 (hosted network started), 11001 (hosted network stopped), 11004 (peer device connected to hosted network)
  2. Windows Bluetooth Operational Logs: Event Viewer > Applications and Services Logs > Microsoft > Windows > Bluetooth-Driver > Operational and Microsoft > Windows > Bluetooth-MTP > Operational — records device pairing, connections, and file transfer initiations
  3. Registry: HKLM\SYSTEM\CurrentControlSet\Services\WlanSvc\Parameters\Interfaces\{Adapter GUID}\MetaData — contains SSID history of all networks the adapter has connected to, including adversary-controlled hotspots
  4. Registry: HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices\{Bluetooth MAC} — pairing records with device name, address class, and last-seen timestamp for every device ever paired
  5. File System: C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.html — Windows built-in wireless diagnostics report with comprehensive connection history including failed connection attempts
  6. Sysmon EVTX: Event ID 1 for process creation of netsh.exe, fsquirt.exe, bttray.exe, and PowerShell with wireless-related command lines; Event ID 11 for files staged in temp directories; Event ID 3 for any coincident outbound network connections
  7. File System: C:\Windows\Prefetch\NETSH.EXE-*.pf and FSQUIRT.EXE-*.pf — Prefetch files contain execution timestamps and are preserved even if event logs are cleared by an adversary
  8. File System: %APPDATA%\Microsoft\Windows\Recent — recently accessed files that may reveal what data the user was staging before the wireless tool execution

Escalation Criteria

  • !Evidence of deliberate data staging (archive creation, bulk file copies to staging directory) in the 60 minutes immediately preceding wireless tool execution on the same device and user account — this behavioral sequence strongly indicates intentional exfiltration preparation
  • !A WiFi hosted network was successfully created and one or more external devices connected during the window — confirmed device connection means data transfer is possible and forensic preservation is critical
  • !A Bluetooth device was paired with the endpoint that does not appear in the authorized peripheral inventory — unrecognized device receiving files from a corporate endpoint is an immediate escalation trigger
  • !The wireless activity originates from a service account, a scheduled task, or a process that would have no legitimate reason to interact with wireless or Bluetooth interfaces (e.g., ccmexec.exe launching netsh wlan start hostednetwork)
  • !The affected endpoint hosts data classified as sensitive, confidential, or restricted (PII, financial, IP, M&A) — the data classification of the endpoint determines the business impact severity
  • !Wireless tool execution occurs outside business hours, from a locked workstation or terminal server session, or immediately after the user performed unusual file access across multiple sensitive directories

Investigation Guide

Related Techniques

T1011.001 — Exfiltration Over Bluetooth (sub-technique covering Bluetooth-specific exfiltration channel)T1020 — Automated Exfiltration (automated staging may precede alternative medium exfiltration)T1074.001 — Local Data Staged (staging files locally before Bluetooth or WiFi transfer)T1560.001 — Archive Collected Data: Archive via Utility (compression before low-bandwidth Bluetooth exfiltration)T1048 — Exfiltration Over Alternative Protocol (parallel technique using non-standard protocols over the primary interface)T1052.001 — Exfiltration Over Physical Medium: USB (related physical exfiltration without network dependency)T1029 — Scheduled Transfer (scheduling data transfers over alternative mediums during off-hours)T1567 — Exfiltration Over Web Service (adversary may use both techniques as backup channels)T1078 — Valid Accounts (insider threat scenarios commonly use legitimate credentials to access data before wireless exfiltration)

Forensic Artifacts

  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\WlanSvc\Parameters\Interfaces\{GUID}\MetaData — full SSID connection history for each wireless adapter including timestamps and adversary-controlled hotspot SSIDs
  • >Registry: HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices\{BT MAC} — complete Bluetooth pairing history with device name, address, class, and last-seen timestamp
  • >Registry: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures — network location awareness records for all networks including ad-hoc and hosted networks
  • >File System: C:\Windows\INF\setupapi.dev.log — records wireless adapter driver installations; a new USB wireless adapter installed by an adversary appears here with timestamp
  • >File System: C:\ProgramData\Microsoft\Windows\WlanReport\wlan-report-latest.html — regenerate with 'netsh wlan show wlanreport' for full wireless event timeline including failed authentication attempts
  • >Event Log: Microsoft-Windows-WLAN-AutoConfig/Operational — Event IDs 8001/8003 (connect/disconnect), 11000/11001 (hosted start/stop), 11004 (peer connected to hosted network) with timestamps
  • >Event Log: Microsoft-Windows-Bluetooth-MTP/Operational — file transfer events including source process, target device, and transferred file metadata when available
  • >Prefetch: C:\Windows\Prefetch\NETSH.EXE-*.pf, FSQUIRT.EXE-*.pf, BTTRAY.EXE-*.pf — execution timestamps and referenced files/DLLs, preserved even after event log tampering

Tuning Guidance

Begin by baselining legitimate wireless tool usage across your endpoint fleet. In enterprise environments, netsh wlan show commands are regularly executed by IT staff, SCCM/Intune agents managing wireless profiles (these will have ccmexec.exe or svchost.exe as parent processes), and network diagnostic tools. Build allowlists using the combination of initiating process + specific command-line substrings rather than broad process name exclusions — for example, allow ccmexec.exe executing 'netsh wlan show profiles' but alert on any process executing 'netsh wlan start hostednetwork' regardless of parent. For fsquirt.exe, if Bluetooth peripherals are authorized in your environment, filter by correlating with known device pairing history; if Bluetooth is fully blocked by policy, any fsquirt.exe execution should alert immediately. The highest-confidence tuning approach is to enforce Group Policy restrictions that disable hosted network functionality (Network > Wireless > Prohibit use of Internet Connection Sharing on your DNS domain network) and block Bluetooth file transfers via device control policy — this simultaneously reduces your attack surface and eliminates an entire class of false positives. Prioritize the staging-correlation hunting query over the individual tool detection for senior analyst review, as the behavioral sequence of stage-then-wireless is substantially more indicative of malicious intent than either activity in isolation.

Hunting Queries

Correlates data staging activity (archive creation, bulk file operations) with wireless tool execution within a one-hour window on the same device and user account. This two-phase pattern — compress/stage data then configure wireless exfiltration channel — is the strongest behavioral indicator of intentional exfiltration preparation and is distinct from the single-event main detection queries.

Hunting — KQL
kql 
// Hunt for data staging immediately followed by wireless tool use on same device
let StagingWindow = 1h;
let StagingActivity = DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName in~ ("7z.exe", "7za.exe", "rar.exe", "winrar.exe", "tar.exe")
    or (FileName in~ ("powershell.exe", "pwsh.exe")
        and ProcessCommandLine has_any (["Compress-Archive", "ZipFile", "robocopy", "xcopy", "Copy-Item"])))
| project StagingTime=Timestamp, DeviceName, AccountName, StagingProcess=FileName, StagingCmd=ProcessCommandLine;
let WirelessActivity = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("netsh.exe", "fsquirt.exe", "bttray.exe")
    or (FileName in~ ("powershell.exe", "pwsh.exe")
        and ProcessCommandLine has_any (["Bluetooth", "WLAN", "WiFi", "NetAdapter", "HostedNetwork"]))
| project WirelessTime=Timestamp, DeviceName, AccountName, WirelessProcess=FileName, WirelessCmd=ProcessCommandLine;
StagingActivity
| join kind=inner WirelessActivity on DeviceName, AccountName
| where WirelessTime between (StagingTime .. (StagingTime + StagingWindow))
| project StagingTime, WirelessTime, DeviceName, AccountName, StagingProcess, StagingCmd, WirelessProcess, WirelessCmd
| sort by StagingTime desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval Image_lc=lower(Image), CmdLine_lc=lower(CommandLine)
| eval IsStaging=if(match(Image_lc, "(7z\.exe|7za\.exe|rar\.exe|winrar\.exe|tar\.exe)") OR (match(Image_lc, "powershell\.exe") AND match(CmdLine_lc, "(compress-archive|zipfile|robocopy|copy-item)")), 1, 0)
| eval IsWireless=if(match(Image_lc, "(netsh\.exe|fsquirt\.exe|bttray\.exe)") OR (match(Image_lc, "powershell\.exe") AND match(CmdLine_lc, "(bluetooth|wlan|wifi|netadapter|hostednetwork)")), 1, 0)
| stats values(Image) as Processes, values(CommandLine) as Commands, sum(IsStaging) as StagingCount, sum(IsWireless) as WirelessCount by host, User, span(_time, 60m)
| where StagingCount > 0 AND WirelessCount > 0
| sort - _time

Hunts for WiFi hotspot creation commands executed outside normal business hours or on weekends. Adversaries — particularly in insider threat scenarios or when operating a remote implant during off-hours — are more likely to initiate alternative exfiltration channels when security monitoring attention is reduced. Time-based anomaly detection on this rare command class is a high-value low-noise signal.

Hunting — KQL
kql 
// Hunt for WiFi hotspot creation commands occurring outside normal business hours
DeviceProcessEvents
| where Timestamp > ago(14d)
| where FileName =~ "netsh.exe"
| where ProcessCommandLine has_any (["hostednetwork", "start hostednetwork", "mode=allow", "mode=disallow"])
| extend HourOfDay = hourofday(Timestamp)
| extend DayOfWeek = dayofweek(Timestamp)
| extend IsAfterHours = (HourOfDay < 8 or HourOfDay > 18)
| extend IsWeekend = (DayOfWeek == 0 or DayOfWeek == 6)
| where IsAfterHours or IsWeekend
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
         InitiatingProcessFileName, HourOfDay, DayOfWeek, IsAfterHours, IsWeekend
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\netsh.exe" (CommandLine="*hostednetwork*" OR CommandLine="*mode=allow*" OR CommandLine="*mode=disallow*")
| eval hour=tonumber(strftime(_time, "%H")), dow=tonumber(strftime(_time, "%u"))
| eval IsAfterHours=if(hour < 8 OR hour > 18, 1, 0)
| eval IsWeekend=if(dow >= 6, 1, 0)
| where IsAfterHours=1 OR IsWeekend=1
| table _time, host, User, CommandLine, ParentImage, ParentCommandLine, hour, dow, IsAfterHours, IsWeekend
| sort - _time

Identifies users or devices executing netsh wlan commands for the first time — accounts with no historical baseline of wireless configuration activity suddenly issuing wireless commands is a strong new-behavior anomaly. This helps surface cases where an adversary has compromised a standard user account that would never ordinarily interact with wireless network tooling.

Hunting — KQL
kql 
// Hunt for endpoints with repeated wireless recon that have not been seen doing this historically
let BaselineWindow = 30d;
let DetectionWindow = 24h;
let HistoricalUsers = DeviceProcessEvents
| where Timestamp between (ago(BaselineWindow) .. ago(DetectionWindow))
| where FileName =~ "netsh.exe" and ProcessCommandLine has "wlan"
| summarize HistoricalDevices=make_set(DeviceName) by AccountName;
let RecentActivity = DeviceProcessEvents
| where Timestamp > ago(DetectionWindow)
| where FileName =~ "netsh.exe" and ProcessCommandLine has "wlan"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine;
RecentActivity
| join kind=leftanti HistoricalUsers on AccountName
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 Image="*\\netsh.exe" CommandLine="*wlan*" earliest=-30d
| eval IsRecent=if(_time > relative_time(now(), "-24h@h"), 1, 0)
| stats sum(IsRecent) as RecentCount, count as TotalCount, values(CommandLine) as Commands by User, host
| where RecentCount > 0 AND TotalCount <= RecentCount
| table User, host, RecentCount, TotalCount, Commands

Atomic Red Team Tests

Test 1 Create and Start WiFi Hosted Network via netsh
windows

Simulates an adversary creating a WiFi software access point (hosted network) on a Windows endpoint using the built-in netsh wlan utility. This establishes an alternative wireless egress channel that an external device in proximity could connect to for receiving exfiltrated data. The hosted network is started and then immediately stopped and disabled to keep the test safe and self-contained.

Command

powershell 
netsh wlan set hostednetwork mode=allow ssid=df00tech-test-exfil key=Argus1234Test! && netsh wlan start hostednetwork

Cleanup

powershell 
netsh wlan stop hostednetwork && netsh wlan set hostednetwork mode=disallow

Expected Telemetry

Sysmon Event ID 1: Two Process Create events — first with CommandLine containing 'wlan set hostednetwork mode=allow ssid=df00tech-test-exfil', second containing 'wlan start hostednetwork'. Security Event ID 4688 if command-line auditing is enabled. Windows WLAN-AutoConfig Operational Event ID 11000 (Microsoft-Windows-WLAN-AutoConfig: The wireless Hosted Network started successfully). Registry change under HKLM\SYSTEM\CurrentControlSet\Services\WlanSvc\Parameters\HostedNetworkSettings.

Expected Detection

KQL: DetectionBranch='NetshWlanConfig', IsHotspotCreation=true. SPL: IsNetshWlan=1, IsHotspotCreation=1, SuspicionScore=2. Both commands match the WirelessHotspotPatterns and IsHotspotCreation extension logic.

Test 2 Launch Bluetooth File Transfer Wizard (fsquirt.exe)
windows

Opens the Windows Bluetooth File Transfer Wizard (fsquirt.exe), which is the built-in Windows utility for initiating Bluetooth OBEX file transfers to nearby Bluetooth devices. This simulates the first stage of Bluetooth-based exfiltration (T1011.001). The wizard is launched via PowerShell and killed after 3 seconds — no actual file transfer occurs, but the process creation event and the Bluetooth adapter activity are generated.

Command

powershell 
powershell.exe -Command "$proc = Start-Process -FilePath '$env:SystemRoot\System32\fsquirt.exe' -PassThru; Start-Sleep -Seconds 3; $proc.Kill()"

Cleanup

powershell 
Stop-Process -Name fsquirt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=C:\Windows\System32\fsquirt.exe, ParentImage=powershell.exe, User=current user. Security Event ID 4688 if command-line auditing is enabled. Bluetooth-Driver Operational log may record adapter activation. No file creation or network connection events since no transfer is completed.

Expected Detection

KQL: DetectionBranch='BluetoothFileTransfer', FileName=~'fsquirt.exe'. SPL: IsBluetoothTool=1, SuspicionScore=1. Alert fires on fsquirt.exe in BluetoothTransferBinaries list regardless of parent process.

Test 3 Wireless Adapter Reconnaissance via PowerShell and netsh
windows

Enumerates wireless network adapters, saved WiFi profiles, and interface status using PowerShell Get-NetAdapter and netsh wlan — reconnaissance activity adversaries perform before configuring an alternative exfiltration channel to identify available wireless capabilities on the compromised endpoint. All commands are read-only and make no configuration changes.

Command

powershell 
powershell.exe -NoProfile -Command "Get-NetAdapter | Where-Object { $_.PhysicalMediaType -eq '802.11' } | Select-Object Name, Status, MacAddress; netsh wlan show interfaces; netsh wlan show profiles"

Expected Telemetry

Sysmon Event ID 1: Process Create for powershell.exe with CommandLine containing 'Get-NetAdapter' and 'PhysicalMediaType'. Child Sysmon Event ID 1 processes for netsh.exe with CommandLine 'wlan show interfaces' and 'wlan show profiles'. PowerShell ScriptBlock Log Event ID 4104 with the full script content.

Expected Detection

KQL: PSWirelessBranch fires on PowerShell with 'NetAdapter' in command line. NetshWlanBranch fires for 'netsh wlan show'. IsWirelessDiscovery=true on the netsh events. SPL: IsPSWirelessManip=1 and IsNetshWlan=1, SuspicionScore=2.

Test 4 Linux Bluetooth Device Discovery and OBEX Transfer Preparation
linux

On a Linux endpoint, uses hciconfig and bluetoothctl to activate the Bluetooth adapter and scan for nearby discoverable devices — the reconnaissance phase an adversary performs before staging an OBEX Bluetooth file transfer for exfiltration. Also demonstrates rfkill usage for adapter management. Requires a system with a Bluetooth adapter present.

Command

bash 
hciconfig hci0 up 2>/dev/null && hcitool scan 2>/dev/null; bluetoothctl -- show 2>/dev/null; rfkill list bluetooth 2>/dev/null; echo 'Bluetooth recon complete'

Cleanup

bash 
hciconfig hci0 down 2>/dev/null || true

Expected Telemetry

Linux auditd (if configured with execve rules): SYSCALL records type=EXECVE for hciconfig, hcitool, bluetoothctl, and rfkill with their arguments and auid/uid/pid context. Syslog/journal entries from the Bluetooth daemon (bluetoothd) showing adapter state transitions. If Microsoft Defender for Linux is deployed, DeviceProcessEvents will record these process creation events.

Expected Detection

Linux Syslog SPL: process creation events for hciconfig and bluetoothctl matching on process name. KQL (MDE Linux agent): DeviceProcessEvents where FileName in ('hciconfig', 'bluetoothctl', 'rfkill') with ProcessCommandLine containing 'scan' or 'up'. Confidence is lower on Linux due to variable logging configuration across distributions.

Related Detections

Tactic Hub

TA0010 Exfiltration

Detection Variants (1)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Sub-techniques (1)

Related Techniques

T1011.001 Exfiltration Over Bluetooth T1020 Automated Exfiltration T1074.001 Local Data Staging T1560.001 Archive via Utility T1048 Exfiltration Over Alternative Protocol T1052.001 Exfiltration over USB T1029 Scheduled Transfer T1567 Exfiltration Over Web Service T1078 Valid Accounts

Same Tactic: Exfiltration

Popular Detections