Clipboard Collection with Xclip Tool - Auditd — Sigma Rule

Rule metadata and linked tags

Author: Pawel Mazur. Source status: test; severity: low. Source dates: 2021-09-24 / 2022-11-26.

{
  "product": "linux",
  "service": "auditd"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: ca55e716f94d7031b1c6fb841af822d792d5111231cafb7ca42f8ea0cb044935

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Clipboard Collection with Xclip Tool - Auditd
id: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf
status: test
description: |
  Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool.
  Xclip has to be installed.
  Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
references:
    - https://linux.die.net/man/1/xclip
    - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
author: 'Pawel Mazur'
date: 2021-09-24
modified: 2022-11-26
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: xclip
        a1:
            - '-selection'
            - '-sel'
        a2:
            - clipboard
            - clip
        a3: '-o'
    condition: selection
falsepositives:
    - Legitimate usage of xclip tools
level: low

Original YAML and metadata in JSON

False positives

• Legitimate usage of xclip tools

Source references

• https://linux.die.net/man/1/xclip
• https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/