Air-Gap Bridging via Rogue Bluetooth Re-Enablement and Courier Device Pairing

// Signal 1: bthserv service re-enabled from Disabled to Automatic/Manual start type
let ServiceReEnable =
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"Services\bthserv" and RegistryValueName == "Start"
| where RegistryValueData in ("2", "3") // 2=Automatic, 3=Manual (re-enabled from 4=Disabled)
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
         InitiatingProcessFileName, RegistryValueData, Signal = "BluetoothServiceReEnabled";
// Signal 2: new Bluetooth device pairing shortly after
let NewPairing =
DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"BTHPORT\Parameters\Devices"
| where ActionType == "RegistryKeyCreated"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName,
         RegistryKey, Signal = "NewBluetoothPairing";
// Signal 3: OBEX file transfer via fsquirt or equivalent
let ObexTransfer =
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("fsquirt.exe", "obexftp", "bluetooth-sendto")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, Signal = "ObexFileTransfer";
// Correlate: service re-enable -> pairing -> transfer, all on same device within 2 hours
ServiceReEnable
| join kind=inner (NewPairing) on DeviceName
| where Timestamp1 > Timestamp and Timestamp1 < Timestamp + 2h
| join kind=inner (ObexTransfer) on DeviceName
| where Timestamp2 > Timestamp1 and Timestamp2 < Timestamp1 + 2h
| extend IsOffHours = hourofday(Timestamp2) < 6 or hourofday(Timestamp2) >= 18
| project DeviceName, AccountName, ServiceReEnableTime = Timestamp, PairingTime = Timestamp1,
         TransferTime = Timestamp2, ObexProcess = FileName, ObexCommandLine = ProcessCommandLine, IsOffHours
| sort by TransferTime desc

| multisearch
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=12 OR EventCode=13)
  TargetObject="*Services\\bthserv\\Start*" (Details="2" OR Details="3" OR Details="0x00000002" OR Details="0x00000003")
  | eval Signal="BluetoothServiceReEnabled"
  | table _time, host, User, TargetObject, Details, Signal ]
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=12
  TargetObject="*BTHPORT\\Parameters\\Devices*" EventType="CreateKey"
  | eval Signal="NewBluetoothPairing"
  | table _time, host, User, TargetObject, Signal ]
[ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\fsquirt.exe" OR Image="*\\obexftp" OR Image="*bluetooth-sendto*")
  | eval Signal="ObexFileTransfer"
  | table _time, host, User, Image, CommandLine, Signal ]
| sort 0 host, _time
| stats list(Signal) as Signals, list(_time) as Times by host
| where mvcount(Signals) >= 3 AND mvfind(Signals, "BluetoothServiceReEnabled") >= 0 AND mvfind(Signals, "NewBluetoothPairing") >= 0 AND mvfind(Signals, "ObexFileTransfer") >= 0

sequence by host.name with maxspan=4h
  [registry where event.type in ("change") and
     registry.path : "*Services\\bthserv\\Start*" and
     registry.data.strings : ("2", "3")]
  [registry where event.type == "creation" and
     registry.path : "*BTHPORT\\Parameters\\Devices\\*"]
  [process where event.type == "start" and
     process.name : ("fsquirt.exe", "obexftp", "bluetooth-sendto")]

SELECT
    DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
    hostname AS Hostname,
    username AS User,
    "TargetObject" AS RegistryKey,
    "Image" AS ProcessImage,
    CASE
        WHEN LOWER("TargetObject") LIKE '%bthserv\\start%' THEN 'BluetoothServiceReEnabled'
        WHEN LOWER("TargetObject") LIKE '%bthport\\parameters\\devices%' THEN 'NewBluetoothPairing'
        WHEN LOWER("Image") LIKE '%fsquirt%' OR LOWER("Image") LIKE '%obexftp%' THEN 'ObexFileTransfer'
        ELSE 'Unclassified'
    END AS Signal
FROM events
WHERE LOGSOURCETYPENAME(logsourceid) = 'Sysmon'
  AND (
    LOWER("TargetObject") LIKE '%bthserv\\start%'
    OR LOWER("TargetObject") LIKE '%bthport\\parameters\\devices%'
    OR LOWER("Image") LIKE '%fsquirt%'
    OR LOWER("Image") LIKE '%obexftp%'
  )
  AND starttime > NOW() - 86400000
ORDER BY hostname, starttime ASC

_sourceCategory=windows/sysmon (EventCode=12 OR EventCode=13 OR EventCode=1)
| where (TargetObject matches "*bthserv*Start*" AND (Details="2" OR Details="3"))
    OR (TargetObject matches "*BTHPORT*Parameters*Devices*" AND EventCode=12)
    OR (Image matches "*fsquirt*" OR Image matches "*obexftp*")
| eval Signal = if(TargetObject matches "*bthserv*", "BluetoothServiceReEnabled",
    if(TargetObject matches "*BTHPORT*", "NewBluetoothPairing", "ObexFileTransfer"))
| stats values(Signal) as Signals, min(_messageTime) as FirstStage, max(_messageTime) as LastStage by ComputerName, User
| where mvcount(Signals) >= 2
| sort by LastStage desc

rule airgap_bluetooth_bridging {
  meta:
    author = "df00tech"
    description = "Detects re-enablement of a policy-disabled Bluetooth service followed by new device pairing and an OBEX file transfer on the same host"
    severity = "HIGH"
    mitre_attack_tactic = "Exfiltration"
    mitre_attack_technique = "T1011.001"
    reference = "https://attack.mitre.org/techniques/T1011/001/"

  events:
    $svc.metadata.event_type = "REGISTRY_MODIFICATION"
    re.regex($svc.target.registry.registry_key, `(?i)bthserv\\start`)
    $pair.metadata.event_type = "REGISTRY_MODIFICATION"
    re.regex($pair.target.registry.registry_key, `(?i)bthport\\parameters\\devices`)
    $xfer.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($xfer.target.process.file.full_path, `(?i)(fsquirt|obexftp)`)
    $hostname = $svc.principal.hostname
    $hostname = $pair.principal.hostname
    $hostname = $xfer.principal.hostname
    $svc.metadata.event_timestamp.seconds < $pair.metadata.event_timestamp.seconds
    $pair.metadata.event_timestamp.seconds < $xfer.metadata.event_timestamp.seconds

  condition:
    $svc and $pair and $xfer
}

#event_simpleName IN ("RegistryOperationEvent", "ProcessRollup2")
| case {
    #event_simpleName="RegistryOperationEvent" AND RegObjectName=/(?i)bthserv\\start/ AND RegStringValue=/^[23]$/ => Signal:="BluetoothServiceReEnabled";
    #event_simpleName="RegistryOperationEvent" AND RegObjectName=/(?i)bthport\\parameters\\devices/ => Signal:="NewBluetoothPairing";
    #event_simpleName="ProcessRollup2" AND FileName=/(?i)(fsquirt|obexftp)/ => Signal:="ObexFileTransfer";
    * => Signal:="Unclassified"
  }
| test(Signal != "Unclassified")
| groupBy([ComputerName, UserName], function=[collect([Signal, "@timestamp"], limit=20)])
| test(array_contains(collect.Signal, "BluetoothServiceReEnabled") AND array_contains(collect.Signal, "NewBluetoothPairing") AND array_contains(collect.Signal, "ObexFileTransfer"))