{"id":"ec127035-a636-4b9a-8555-0efd4e59f316","title":"Clipboard Collection with Xclip Tool","description":"Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.\nHighly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.\n","author":"Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"low","date":"2021-10-15","modified":"2022-09-15","tags":["attack.collection","attack.t1115"],"technique_ids":["T1115"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Legitimate usage of xclip tools."],"references":["https://www.packetlabs.net/posts/clipboard-data-security/"],"source_path":"rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml","source_sha256":"0bf5c63d8a5e343064f4a6aedba5c7dab7c5ad6b8df0e1df4b268b5fbf802ec2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Clipboard Collection with Xclip Tool\nid: ec127035-a636-4b9a-8555-0efd4e59f316\nstatus: test\ndescription: |\n    Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.\n    Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.\nreferences:\n    - https://www.packetlabs.net/posts/clipboard-data-security/\nauthor: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC\ndate: 2021-10-15\nmodified: 2022-09-15\ntags:\n    - attack.collection\n    - attack.t1115\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|contains: 'xclip'\n        CommandLine|contains|all:\n            - '-sel'\n            - 'clip'\n            - '-o'\n    condition: selection\nfalsepositives:\n    - Legitimate usage of xclip tools.\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1115","id":"T1115","name":"Clipboard Data","page":"techniques/enterprise/T1115/"}],"data_path":"data/detection-rules/ec127035-a636-4b9a-8555-0efd4e59f316.json","kind":"sigma"}