jamf_protectinformationalTTP

Bluetooth File Exchange Inbound

This detection functions by monitoring for file system activity in a known location by the OBEXAgent service and will provide the file name, save destination path and user involved.

Detection Query

$event.type == 3 AND $event.process.signingInfo.appid == "com.apple.OBEXAgent" AND $event.prevFile CONTAINS "/com.apple.OBEXAgent/TemporaryItems/NSIRD_OBEXAgent"

Author

Jamf

Data Sources

File System EventsmacOS Endpoint Security

Platforms

macos

Tags

Visibility

Raw Content

---
name: BleutoothFileExchangeInbound
uuid: 1f1a1c74-750e-4a04-b766-73a7e6e66ee0
longDescription: This detection functions by monitoring for file system activity in a known location by the OBEXAgent service and will provide the file name, save destination path and user involved.
level: 0
inputType: GPFSEvent
tags: null
snapshotFiles: []
filter: $event.type == 3 AND
  $event.process.signingInfo.appid == "com.apple.OBEXAgent" AND
  $event.prevFile CONTAINS "/com.apple.OBEXAgent/TemporaryItems/NSIRD_OBEXAgent"
actions:
  - name: Log
context: []
categories:
  - Visibility
version: 1
severity: Informational
shortDescription: Bluetooth file exchange inbound
label: Bluetooth File Exchange Inbound
remediation: null
MitreCategories:
  - Visibility