Linux auditd: xclip Clipboard Collection via Selection and Output Option

title: "Linux auditd: xclip Clipboard Collection via Selection and Output Option"
id: d275714a-5fca-48fe-b03f-dd229f39ed6f
status: test
description: This rule flags executions of the xclip utility intended to collect data from the system clipboard by matching the xclip selection parameters (-selection or -sel) with target names (clipboard or clip) and the output option (-o). Clipboard collection can be used to quickly capture user data from a running session without direct file access. The detection relies on auditd execve telemetry that records the executed command and its arguments.
references:
  - https://linux.die.net/man/1/xclip
  - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_clipboard_collection.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-24
modified: 2022-11-26
tags:
  - attack.collection
  - attack.t1115
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: xclip
    a1:
      - -selection
      - -sel
    a2:
      - clipboard
      - clip
    a3: -o
  condition: selection
falsepositives:
  - Legitimate usage of xclip tools
level: low
license: DRL-1.1
related:
  - id: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf
    type: derived