topic Re: Blocking Bluetooth Device in XDR??? in Cortex XDR Discussions

Blocking Bluetooth Device in XDR???

SeanDeHarris — Wed, 06 Apr 2022 11:16:44 GMT

Hello,

Seems XDR - Device control only block USB-related devices on the Endpoint, is it blocking any new Bluetooth devices if the GUID is unknown?

any ideas?

bbarmanroy — Thu, 07 Apr 2022 01:29:19 GMT

Hi @SeanDeHarris you can consider leveraging on MDM controls to disable bluetooth on endpoints.

SeanDeHarris — Thu, 07 Apr 2022 04:26:57 GMT

Thanks for your sharing.

I did some testing with the GUID, the Bluetooth devices will be blocked either by the Class GUID for Network Adaptor or Bluetooth level.

Network Adaptor (Bluetooth device PAN)
{4d36e972-e325-11ce-bfc1-08002be10318}

Bluetooth

{e0cbf06c-cd8b-4647-bb8a-263b43f0f974}

With the class GUID of Bluetooth device, it will block everything bluetoothish, eg built-in Windows bluetooth services, headset, mouse...

Seems cannot block individual bluetooth headset.

eluis — Thu, 07 Apr 2022 08:15:50 GMT

every single device should have a unique number for identifying it, try to investigate which one is yours.

This number appears an registry keys once you plug it in on a windows system

the same with bluetooth or any other device connected. Otherwise the OS wont be able to handle it.

This unique identifiers are used as evidences in courts of law when performing forensics and they all leave traces in registry keys