Covert Data Exfiltration via Bluetooth LE Advertising Packet Encoding (Beacon Stuffing)

let AdvertisingCliTools = dynamic(["hcitool", "btmgmt"]);
let BleScriptMarkers = dynamic(["bleak", "bluepy", "pybluez", "gatttool"]);
// Signal 1: raw HCI advertising-data-set command issued directly via CLI rather than a vendor beacon daemon
let RawHciAdvertising = DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOS =~ "Linux"
| where FileName in~ (AdvertisingCliTools)
| where ProcessCommandLine has_any ("cmd 0x08 0x0008", "cmd 0x08 0x0006", "add-adv", "advertise on", "advertising on")
| extend Signal = "RawHciAdvertisingCommand"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;
// Signal 2: scripted BLE advertising via a Python BLE library
let ScriptedBleAdvertising = DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceOS =~ "Linux"
| where FileName in~ ("python", "python3")
| where ProcessCommandLine has_any (BleScriptMarkers)
| where ProcessCommandLine has_any ("advertis", "adv_data", "set_advertising", "AdvertisingData")
| extend Signal = "ScriptedBleAdvertising"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal;
// Correlate: same host repeatedly re-issuing an advertising-set command/script within a short window
RawHciAdvertising
| union ScriptedBleAdvertising
| summarize InvocationCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
    Commands = make_set(ProcessCommandLine, 25), Signals = make_set(Signal)
    by DeviceName, AccountName
| where InvocationCount >= 8
| where LastSeen - FirstSeen <= 10m
| sort by InvocationCount desc

index=linux sourcetype="linux:audit" type=EXECVE
(
  (exe IN ("*/hcitool","*/btmgmt") AND (a0="*0x0008*" OR a0="*0x0006*" OR a0="*add-adv*" OR a0="*advertise*"))
  OR (exe IN ("*/python","*/python3") AND (a0="*bleak*" OR a0="*bluepy*" OR a0="*pybluez*" OR a0="*gatttool*"))
)
| eval Signal=case(match(exe, "(?i)(hcitool|btmgmt)"), "RawHciAdvertisingCommand", match(exe, "(?i)python"), "ScriptedBleAdvertising", true(), "Other")
| bin _time span=10m
| stats count as InvocationCount, values(a0) as Args, min(_time) as FirstSeen, max(_time) as LastSeen by host, uid, _time, Signal
| where InvocationCount >= 8
| sort - InvocationCount

process where host.os.family == "linux" and event.type == "start" and (
  (process.name in ("hcitool", "btmgmt") and process.command_line : ("*0x0008*", "*0x0006*", "*add-adv*", "*advertise*")) or
  (process.name in ("python", "python3") and process.command_line : ("*bleak*", "*bluepy*", "*pybluez*", "*gatttool*") and process.command_line : ("*advertis*", "*adv_data*"))
)

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  hostname AS Hostname,
  username AS Username,
  "exe" AS Executable,
  "a0" AS Arg0,
  CASE
    WHEN LOWER("exe") LIKE ANY ('%hcitool%','%btmgmt%') THEN 'RawHciAdvertisingCommand'
    WHEN LOWER("exe") LIKE ANY ('%python%') AND LOWER("a0") LIKE ANY ('%bleak%','%bluepy%','%pybluez%','%gatttool%') THEN 'ScriptedBleAdvertising'
    ELSE 'Other'
  END AS Signal
FROM events
WHERE
  LOGSOURCETYPENAME(logsourceid) IN ('Linux OS', 'Linux Audit')
  AND QIDNAME(qid) LIKE '%EXECVE%'
  AND (
    LOWER("exe") LIKE ANY ('%hcitool%','%btmgmt%')
    OR (LOWER("exe") LIKE '%python%' AND LOWER("a0") LIKE ANY ('%bleak%','%bluepy%','%pybluez%','%gatttool%'))
  )
  AND starttime > NOW() - 86400000
ORDER BY EventTime DESC

_sourceCategory=linux/auditd type=EXECVE
| parse "exe=\"*\"" as Exe nodrop
| parse "a0=\"*\"" as Arg0 nodrop
| where (Exe matches "*hcitool*" or Exe matches "*btmgmt*")
    or (Exe matches "*python*" and (Arg0 matches "*bleak*" or Arg0 matches "*bluepy*" or Arg0 matches "*pybluez*" or Arg0 matches "*gatttool*"))
| eval Signal = if(Exe matches "*hcitool*" or Exe matches "*btmgmt*", "RawHciAdvertisingCommand", "ScriptedBleAdvertising")
| stats count as EventCount, values(Arg0) as Args by _sourceHost, Exe, Signal
| where EventCount >= 8
| sort by EventCount desc

rule ble_advertising_channel_exfil {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects connectionless BLE advertising-channel data exfiltration via raw HCI commands or scripted BLE libraries"
    severity = "MEDIUM"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1011.001"
    created = "2026-09-10"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.platform = "LINUX"
    (
      re.regex($e.target.process.file.full_path, `(?i)(hcitool|btmgmt)$`) and
      re.regex($e.target.process.command_line, `(?i)(0x0008|0x0006|add-adv|advertise)`)
    )
    or
    (
      re.regex($e.target.process.file.full_path, `(?i)python`) and
      re.regex($e.target.process.command_line, `(?i)(bleak|bluepy|pybluez|gatttool)`) and
      re.regex($e.target.process.command_line, `(?i)(advertis|adv_data)`)
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| Platform="Linux"
| (
    (FileName=/(?i)(hcitool|btmgmt)$/ AND CommandLine=/(?i)(0x0008|0x0006|add-adv|advertise)/)
    OR (FileName=/(?i)python/ AND CommandLine=/(?i)(bleak|bluepy|pybluez|gatttool)/ AND CommandLine=/(?i)(advertis|adv_data)/)
  )
| Signal := case {
    FileName=/(?i)(hcitool|btmgmt)/ => "RawHciAdvertisingCommand";
    * => "ScriptedBleAdvertising"
  }
| groupBy([ComputerName, UserName, FileName, Signal], function=[count(as=InvocationCount), collect(CommandLine, limit=25)])
| test(InvocationCount >= 8)
| sort(InvocationCount, order=desc)