Clipboard Collection of Image Data with Xclip Tool — Sigma Rule

Rule metadata and linked tags

Author: Pawel Mazur. Source status: test; severity: low. Source dates: 2021-10-01 / 2022-10-09.

{
  "product": "linux",
  "service": "auditd"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: e8e66d9c95cd2a57656c356a3862abfb195466fae023cd942d321f4dc0e904d7

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Clipboard Collection of Image Data with Xclip Tool
id: f200dc3f-b219-425d-a17e-c38467364816
status: test
description: |
  Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool.
  Xclip has to be installed.
  Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
references:
    - https://linux.die.net/man/1/xclip
author: 'Pawel Mazur'
date: 2021-10-01
modified: 2022-10-09
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: xclip
        a1:
            - '-selection'
            - '-sel'
        a2:
            - clipboard
            - clip
        a3: '-t'
        a4|startswith: 'image/'
        a5: '-o'
    condition: selection
falsepositives:
    - Legitimate usage of xclip tools
level: low

Original YAML and metadata in JSON

False positives

• Legitimate usage of xclip tools

Source references

• https://linux.die.net/man/1/xclip