Masqueraded Bluetooth Service Persistence via Non-Standard Path

Ethan Andrews@eandrews

•updated Feb 20, 2026•5•0•82

Detects the creation or modification of a Windows service named 'BluetoothService' where its executable path points to a non-standard, user-writable location (e.g., AppData, Temp, ProgramData). This technique is often used by malware, such as the Chrysalis backdoor in the Lotus Blossom campaign, to establish persistence and evade detection by masquerading as a legitimate system service.