Clipboard Collection with Xclip Tool - Auditd

Status: test
Severity: low
Log source: product linux, service auditd
Author: Pawel Mazur
Source: github.com/SigmaHQ/sigma

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Known false positives

Legitimate usage of xclip tools

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1115` Clipboard Data

Telemetry coverage

Platform	Record / event type
Linux	auditd EXECVE record: Arguments supplied to the execve system call

Rule body

title: Clipboard Collection with Xclip Tool - Auditd
id: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf
status: test
description: |
  Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool.
  Xclip has to be installed.
  Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
references:
    - https://linux.die.net/man/1/xclip
    - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
author: 'Pawel Mazur'
date: 2021-09-24
modified: 2022-11-26
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: xclip
        a1:
            - '-selection'
            - '-sel'
        a2:
            - clipboard
            - clip
        a3: '-o'
    condition: selection
falsepositives:
    - Legitimate usage of xclip tools
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    type: EXECVE
    a0: xclip
    a1:
        - '-selection'
        - '-sel'
    a2:
        - clipboard
        - clip
    a3: '-o'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`a0`	eq	`xclip`	`field:"a0" kind:eq value:"xclip"`
`a1`	eq	`-sel` `-selection`	`field:"a1" kind:eq`
`a2`	eq	`clip` `clipboard`	`field:"a2" kind:eq`
`a3`	eq	`-o`	`field:"a3" kind:eq value:"-o"`
`type`	eq	`EXECVE`	`field:"type" kind:eq value:"EXECVE"`