Detection: Windows Bluetooth Service Installed From Uncommon Location

Description

Identifies the creation of a Windows service named "BluetoothService" with a binary path in user-writable directories, particularly %AppData%\Bluetooth. This technique was observed in the Lotus Blossom Chrysalis backdoor campaign, where attackers created a service named "BluetoothService" pointing to a malicious binary (renamed Bitdefender Submission Wizard) in a hidden AppData directory. While legitimate Bluetooth services exist in Windows, they are system services with binaries in System32. Any BluetoothService created with a binary path in user directories (AppData, Temp, Downloads) is highly suspicious and indicates potential malware persistence.

Search

 1`wineventlog_system`
 2EventCode=7045
 3ServiceName IN (
 4    "BluetoothService",
 5    "Bluetooth Service"
 6)
 7ImagePath IN (
 8    "*\\AppData\\*",
 9    "*\\ProgramData\\*",
10    "*\\Temp\\*",
11    "*\\Users\\*\\Bluetooth\\*"
12)
13
14| stats count min(_time) as firstTime max(_time) as lastTime
15  by Computer ServiceName ImagePath ServiceType StartType UserID
16
17| rename Computer as dest
18         UserID as user_id
19
20| `security_content_ctime(firstTime)`
21
22| `security_content_ctime(lastTime)`
23
24| `windows_bluetooth_service_installed_from_uncommon_location_filter`

Data Source

Name	Platform	Sourcetype	Source
Windows Event Log System 7045	Windows	'XmlWinEventLog'	'XmlWinEventLog:System'

Macros Used

Annotations

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Implementation

To successfully implement this search, you need to be ingesting Windows System Event Logs (Event ID 7045) from your Windows endpoints. Event ID 7045 logs service installation events and includes the service name, binary path, service type, and start type.

Ensure Windows Event Log forwarding is configured to send System logs to Splunk, or use a Windows Event Log collection agent. The Splunk Add-on for Microsoft Windows is required to properly parse these events.

Known False Positives

Legitimate Bluetooth services in Windows are system services located in System32. Any BluetoothService created outside of system directories is highly suspicious. However, false positives may occur if:

1. Third-party Bluetooth software installs services in Program Files (excluded by this detection)
2. Development or testing environments create test services

The detection specifically targets user-writable directories (AppData, Temp) which are strong indicators of malicious activity. Allowlist known-good third-party Bluetooth software installation paths if needed.

Associated Analytic Story

• Lotus Blossom Chrysalis Backdoor

Risk Based Analytics (RBA)

Risk Message:

Suspicious BluetoothService created on $dest$ with binary path $ImagePath$ in user-writable directory, indicating potential malware persistence

References

• https://attack.mitre.org/techniques/T1543/003/

• https://attack.mitre.org/techniques/T1036/

• https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

Detection Testing

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub | Version: 1