If you want to block only the File Transfer over Bluetooth for Windows 10 version 1809 and later, create an Application File Access Protection Rule in DLP or Access Protection Rule in ENS. You can create the rule instead of following the steps under the "Windows 10 version 1809 to Current" section in KB91976 - How to block file transfers via Bluetooth.

To create the Application File Access Protection Rule in DLP, perform the steps below:

1. Log on to the ePolicy Orchestrator (ePO) console.
2. Go to Menu, Data Protection, and select DLP Policy Manager. 
3. Under Rule Sets, click the appropriate Rule Set.
4. On the DLP Rule Set page, select the Data Protection tab. 
5. Click the Actions drop-down list and select New Rule, Application File Access Protection.
6. On the Application File Access Protection page, perform the steps below:
   1. Enter a Rule Name.  
   2. Set the State to Enabled.
   3. Set the Severity according to your requirement.
   4. On the Condition tab, click the three dots next to Classification. 
   5. Select the Classification and End-User of your choice.
   6. Click the three dots next to Applications and click New Item.
   7. Enter the Application Template name and leave the rest to its default.
   8. Under the Available Properties section, select the Property Original Executable File Name.
   9. Set the Value as fsquirt.exe. Click Save.
   10. Select the Application Template name that was saved in the previous step, and click OK.
   11. On the Reaction tab, set the following:
       1. Set the Action to Block.  
       2. Click the three dots next to the User Notification and select a notification from the list. Click OK.
       3. Select the Report Incident option and select the Store original file as evidence if you want to store evidence files.
       4. Click Save and Close.
7. Apply the rule set to a new policy and assign the same to the endpoint systems. Fsquirt.exe is responsible for the Bluetooth File Transfer wizard in Windows. According to the DLP Application File Access Protection Rule above, the classified files accessed by Fsquirt.exe are blocked. As a result, this rule blocks the classified files from being transferred through the Bluetooth File Transfer wizard in Windows. 
   
   NOTE: The files transferred using the Bluetooth File Transfer wizard are empty if you view them on the destination system. These empty files are according to product design.
    
8. Apply the policy changes through the Policy Assignment.
    

To create the Access Protection Rule in ENS, perform the steps below:

Fsquirt.exe is responsible for the Bluetooth File Transfer wizard in Windows. Hence, you can block the exe from the AV software instead of DLP. 

NOTES:

• You can also use these steps to block fsquirt.exe from other AV solutions.
• This is an example Access Protection rule. The operating system functionality can change, making the following Access Protection rule obsolete. Trellix neither owns or maintains any part of the Bluetooth stack, nor offers support for custom Access Protection or Exploit Prevention rules. 
• Custom rules can be implemented at your own risk. We recommend setting new or updated rules to 'Report' only and test prior to enabling both Block and Report.

Following are the steps to block fsquirt.exe in the ENS Access Protection Policy:

1. Log on to the ePO console.
2. Go to Menu, Policy Catalog.
3. Select the Endpoint Security Threat Prevention Policy.
4. Click Edit to modify an existing policy or Duplicate to create a new policy based on the selected policy for testing.
5. Within the policy, select Show Advanced and make sure that Access Protection is enabled in the policy.
6. Under Rules, click Add. 
7. Name the rule Block All processes from run access (execute) to target process fsquirt.exe.
8. Select Block & Report under Action or select only Report to test prior enforcing the rule.
9. Under Executables, Click Add and define the executable as follows:
   1. Name: All Processes
   2. Inclusion status: Include
   3. File name or path (can include * or ? wildcards): *
   4. Leave all other fields blank.
   5. Select Save.
10. Scroll-down to create a subrule that defines the target process.
11. Under Subrules, click Add
12. Name the subrule Block run access (execute) to fsquirt.exe.
13. Select Processes from the Subrule type drop-down list.
14. Select Run from the Operations list.
15. Scroll-down to the Target section and click Add.
16. Define the executable as follows
    1. Name: fsquirt
    2. Inclusion status: Include
       
       WARNING: Failure to select "Include" here will turn this into a "Block everything" rule!
        
    3. File name or path (can include * or ? wildcards): fsquirt.exe
    4. Leave all other fields blank.
    5. Select Save to save the executable.
17. Select Save to save the Subrule.
18. Select Save to save the policy.