1200KM / detection
T1011.001 Exfiltration Over Bluetooth — Detection Rules
Detection workspace for T1011.001 Exfiltration Over Bluetooth: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0554 Detection of Bluetooth-Based Data Exfiltration
AN1531 Analytic 1531
Detection of non-interactive or suspicious processes accessing Bluetooth interfaces and transmitting outbound traffic following file access or staging activity.
AN1532 Analytic 1532
Use of hcitool, bluetoothctl, or rfcomm to initialize Bluetooth connection paired with recent file reads by the same user or session.
AN1533 Analytic 1533
Observation of `blueutil`/`networksetup` commands or low-level APIs toggling Bluetooth or initiating transfers, especially if paired with recent large file read activity by non-GUI processes.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1011.001 simulation workspace
- Command Execution · DC0064
- File Access · DC0055
- File Creation · DC0039
- Network Connection Creation · DC0082
- Process Creation · DC0032
No reviewed association in this snapshot.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.