Clipboard Collection of Image Data with Xclip Tool

Status: test
Severity: low
Log source: product linux, service auditd
Author: Pawel Mazur
Source: github.com/SigmaHQ/sigma

Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Known false positives

Legitimate usage of xclip tools

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1115` Clipboard Data

Telemetry coverage

Platform	Record / event type
Linux	auditd EXECVE record: Arguments supplied to the execve system call

Rule body

title: Clipboard Collection of Image Data with Xclip Tool
id: f200dc3f-b219-425d-a17e-c38467364816
status: test
description: |
  Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool.
  Xclip has to be installed.
  Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
references:
    - https://linux.die.net/man/1/xclip
author: 'Pawel Mazur'
date: 2021-10-01
modified: 2022-10-09
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: xclip
        a1:
            - '-selection'
            - '-sel'
        a2:
            - clipboard
            - clip
        a3: '-t'
        a4|startswith: 'image/'
        a5: '-o'
    condition: selection
falsepositives:
    - Legitimate usage of xclip tools
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    type: EXECVE
    a0: xclip
    a1:
        - '-selection'
        - '-sel'
    a2:
        - clipboard
        - clip
    a3: '-t'
    a4|startswith: 'image/'
    a5: '-o'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`a0`	eq	`xclip`	`field:"a0" kind:eq value:"xclip"`
`a1`	eq	`-sel` `-selection`	`field:"a1" kind:eq`
`a2`	eq	`clip` `clipboard`	`field:"a2" kind:eq`
`a3`	eq	`-t`	`field:"a3" kind:eq value:"-t"`
`a4`	starts_with	`image/`	`field:"a4" kind:starts_with value:"image/"`
`a5`	eq	`-o`	`field:"a5" kind:eq value:"-o"`
`type`	eq	`EXECVE`	`field:"type" kind:eq value:"EXECVE"`