Detection rules › Elastic
Clipboard accessed by Unsigned or Untrusted Binary
Detects when an unsigned or untrusted binary attempts to access the Pasteboard XPC service in order to collect Clipboard data. Threat actors will monitor the clipboard or collect its contents in order to gain access to sensitive information such as passwords and seedphrases.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection |
Telemetry coverage
Rule body
[rule]
description = """
Detects when an unsigned or untrusted binary attempts to access the Pasteboard XPC service in order to collect Clipboard
data. Threat actors will monitor the clipboard or collect its contents in order to gain access to sensitive information
such as passwords and seedphrases.
"""
id = "71ebb1e8-8089-4843-bdd7-8ae992c7df93"
license = "Elastic License v2"
name = "Clipboard accessed by Unsigned or Untrusted Binary"
os_list = ["macos"]
reference = [
"https://github.com/MythicAgents/poseidon/blob/master/Payload_Type/poseidon/poseidon/agentfunctions/clipboard.go",
"https://github.com/MythicAgents/poseidon/blob/master/Payload_Type/poseidon/poseidon/agentfunctions/clipboard_monitor.go",
]
version = "1.0.3"
query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "fork" and process.name == "launchd" and
process.args like "xpcproxy" and process.args like "com.apple.pasteboard*" and
process.args_count == 2]
[process where event.type == "start" and event.action == "exec" and
(process.code_signature.trusted == false or process.code_signature.exists == false)]
'''
min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1115"
name = "Clipboard Data"
reference = "https://attack.mitre.org/techniques/T1115/"
[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"
[internal]
min_endpoint_version = "8.11.0"
Stages and Predicates
Ordered sequence: each step below must occur in order within 10s, correlated by process.entity_id.
Stage 1: process
[process where event.type == "start" and event.action == "fork" and process.name == "launchd" and
process.args like "xpcproxy" and process.args like "com.apple.pasteboard*" and
process.args_count == 2]
Stage 2: process
[process where event.type == "start" and event.action == "exec" and
(process.code_signature.trusted == false or process.code_signature.exists == false)]
Indicators
These rows show field, operator, and value matches.