Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
2
1
Platforms
2
Products / Services
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
2
IDS Protocols
1
1
This rule detects Bluetooth Object Exchange (OBEX) Protocol data transfer activity on TCP port 3232. The rule is configured to alert when five such data transfers are observed from the same source IP within a 60-second window, indicating potential exfiltration or unauthorized data movement over Bluetooth.
This rule detects potential data exfiltration over Bluetooth Network Encapsulation Protocol (BNEP) by monitoring UDP traffic on port 3232. It triggers an alert if more than 5 such packets are observed from a single source within a 60-second window, indicating a possible attempt to transfer data out of the network via Bluetooth.