Bluetooth Network Encapsulation Data Exfiltration

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects potential data exfiltration over Bluetooth Network Encapsulation Protocol (BNEP) by monitoring UDP traffic on port 3232. It triggers an alert if more than 5 such packets are observed from a single source within a 60-second window, indicating a possible attempt to transfer data out of the network via Bluetooth.