T1011.001 — Exfiltration Over Bluetooth

Tactic: Exfiltration · Platforms: Linux, macOS, Windows

Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel. Adversaries may choose to do this if they have…

Sub-technique of Exfiltration Over Other Network Medium (T1011).

Sigma detection rules (3)

T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth

title: "T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
id: f3ddbf07-86a7-4f21-ba4e-96acdbb7d02a
description: 'Detection of Bluetooth-Based Data Exfiltration. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, InterfaceType, FileSizeThreshold.'
references:
  - https://attack.mitre.org/techniques/T1011/001
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.exfiltration
  - attack.t1011.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    Image|endswith:
      - '\fsquirt.exe'
      - '\btpanui.exe'

  condition: selection

falsepositives:
  - Legitimate user-initiated Bluetooth file transfers via Windows' own Bluetooth file-transfer UI. Standard Windows Event Logs and Sysmon do not observe Bluetooth PAN traffic directly — this rule only catches the launch of Windows' built-in transfer helper, not arbitrary Bluetooth exfiltration. Recommend a dedicated Bluetooth/DLP monitoring agent for real coverage.

level: informational

T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth

title: "T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
id: 58aa190c-57f5-4570-8a8b-60ecc6f4c436
description: 'Detection of Bluetooth-capable utility execution as a coarse proxy for Exfiltration Over Bluetooth. Linux auditd operates at the syscall layer and does not natively decode Bluetooth L2CAP/RFCOMM socket traffic, so the actual data transfer over a Bluetooth channel is not observable; the previous logsource category (network_connection) was also mismatched against the actual EXECVE/process_creation selection it contained. Corrected to a process_creation logsource -- this rule can only flag that a Bluetooth file-transfer-capable tool was executed, not that exfiltration occurred. Tune using: BluetoothUtility, SessionWindow.'
references:
  - https://attack.mitre.org/techniques/T1011/001
author: Shahrukh Khan
date: 2026-04-21
license: MIT
tags:
  - attack.exfiltration
  - attack.t1011.001

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/bluetoothctl'
      - '/obexftp'
      - '/rfcomm'

  condition: selection

falsepositives:
  - auditd syscall auditing does not capture Bluetooth L2CAP/RFCOMM socket-level traffic; this only detects execution of Bluetooth utilities, which are also used for legitimate device pairing and file transfer (e.g. transferring files to a paired phone).

level: medium

T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth

title: "T1011.001 Exfiltration Over Other Network Medium: Exfiltration Over Bluetooth"
id: 9edd0d2a-92b6-410c-af59-7bae00e782ac
description: 'Detection of Bluetooth-Based Data Exfiltration. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ProcessContext, PayloadType.'
references:
  - https://attack.mitre.org/techniques/T1011/001
author: Shahrukh Khan
date: 2026-02-04
license: MIT
tags:
  - attack.exfiltration
  - attack.t1011.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/blued'
      - '/sharingd'
  selection_parent:
    ParentImage|endswith:
      - '/python3'
      - '/osascript'
  condition: selection and selection_parent

falsepositives:
  - Native Bluetooth file-sharing (AirDrop-adjacent) daemons operating normally, since actual Bluetooth payload transfer is not surfaced as a process_creation event.

level: medium

Explore