Quick Share V5 Plaintext Control Frame Injection Post-UKEY2 Handshake
Detects the transmission of plaintext 'OfflineFrame' protocol messages (such as CONNECTIONRESPONSE, BANDWIDTHUPGRADE, or KEEPALIVE) within the 'Nearby Connections' protocol that lack required encryption ('SecureMessage') after the UKEY2 key exchange phase. This behavior indicates a potential misconfiguration or an attempt to intercept/manipulate Nearby Connections traffic.
Splunk (SPL)
