Clipboard Collection with Xclip Tool

Status: test
Severity: low
Log source: category process_creation, product linux
Author: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
Source: github.com/SigmaHQ/sigma

Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.

Known false positives

Legitimate usage of xclip tools.

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1115` Clipboard Data

Telemetry coverage

Platform	Record / event type
Linux	Event ID 1: Process Create

Rule body

title: Clipboard Collection with Xclip Tool
id: ec127035-a636-4b9a-8555-0efd4e59f316
status: test
description: |
    Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.
    Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
references:
    - https://www.packetlabs.net/posts/clipboard-data-security/
author: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
date: 2021-10-15
modified: 2022-09-15
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|contains: 'xclip'
        CommandLine|contains|all:
            - '-sel'
            - 'clip'
            - '-o'
    condition: selection
falsepositives:
    - Legitimate usage of xclip tools.
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|contains: 'xclip'
    CommandLine|contains|all:
        - '-sel'
        - 'clip'
        - '-o'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-o` `-sel` `clip`	`field:"CommandLine" kind:match`
`Image`	match	`xclip`	`field:"Image" kind:match value:"xclip"`