Exfiltration Over Bluetooth (T1011.001) is a sub-technique of Exfiltration Over Other Network Medium. Adversaries try to exfiltrate data over Bluetooth rather than the command and control channel. MITRE lists Linux, macOS and Windows.
How attackers use it
If the C2 channel is a wired internet connection, an adversary with sufficient access and proximity may use Bluetooth instead. MITRE says these connections might not be secured or defended as well as the primary channel, because they are not routed through the same enterprise network. Proximity is the limit, which makes this rarer than network exfiltration, but it is outside the reach of most network tools.
How to detect it
MITRE's analytics cover each platform:
- Windows: non-interactive or suspicious processes accessing Bluetooth interfaces and sending traffic after file access or staging.
- Linux: use of hcitool, bluetoothctl or rfcomm to start a Bluetooth connection, paired with recent file reads by the same user or session.
- macOS: blueutil or networksetup commands, or low-level APIs, toggling Bluetooth or starting transfers, especially after large file reads by non-GUI processes.
The pattern is a file read followed shortly by Bluetooth activity from a process that is not a normal user application.
How to reduce the risk
MITRE lists:
- Disable or Remove Feature or Program: disable Bluetooth in local computer security settings or group policy if it is not needed.
- Operating System Configuration: prevent the creation of new network adapters where possible.
Practical controls
Bluetooth is a feature many fleets never use for business. Turning it off is a quick win. Do it in firmware or through group policy on servers, kiosks and desktops, and keep it on only for the groups that need it, such as laptops that use wireless headsets.
For machines that keep Bluetooth, restrict pairing. Only managed devices should pair, and users should not be able to add new ones without approval. Log pairing events and review unknown device names.
Remember what scope you are defending. Bluetooth exfiltration needs someone nearby, so the sites that matter most are those where unknown people can get close: reception areas, shared offices and public spaces.
Quick check
What is the main limit on Bluetooth exfiltration?
The adversary needs sufficient access and proximity. That is also why network-based monitoring will not see it.
