Techniques › T1011 › T1011.001
T1011.001 Exfiltration Over Bluetooth
exfiltration — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1011.001
0
KEV CVEs mapped here
<p>Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel. If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.</p><p>Adversaries may choose to do this if they have sufficient access and proximity. Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0554 Detection of Bluetooth-Based Data Exfiltration v1.0
AN1531 WindowsDetection of non-interactive or suspicious processes accessing Bluetooth interfaces and transmitting outbound traffic following file access or staging activity.Tunable:
TimeWindowInterfaceTypeFileSizeThresholdAN1532 LinuxUse of hcitool, bluetoothctl, or rfcomm to initialize Bluetooth connection paired with recent file reads by the same user or session.Tunable:BluetoothUtilitySessionWindowAN1533 macOSObservation ofblueutil/networksetupcommands or low-level APIs toggling Bluetooth or initiating transfers, especially if paired with recent large file read activity by non-GUI processes.Tunable:ProcessContextPayloadType
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1011.001
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.