Clipboard Data Collection via xclip (auditd Linux EXECVE)

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1115Clipboard Data
C2
Exfiltration
Impact

What it detects

This rule flags execution of the xclip utility with arguments targeting clipboard or primary selection output (e.g., -selection/-sel with clipboard/clip) and using the -o option. Attackers may use xclip to quickly collect or exfiltrate user-accessible clipboard contents. It relies on auditd telemetry capturing process execution events (EXECVE) and the specific command-line arguments passed to xclip.

Reporting behind it

Related detections9 linkedT1115 — drag to rearrange

Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)

Possible Clipboard Data Capture via PowerShell (via process_creation)

macOS pbpaste Clipboard Read via Process Execution

macOS osascript Clipboard Access via AppleScript Commands

Linux Clipboard Data Collection via xclip -sel clip -o

Linux xclip Clipboard Image Collection via Image MIME Types

Windows: clip.exe Execution to Copy Data to Clipboard

Windows PowerShell Get-Clipboard Command Execution

PowerShell Get-Clipboard Cmdlet Execution via CLI on Windows

Clipboard Data Collection via xclip (auditd Linux EXECVE)

Pivot detection · T1115 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-xclip-clipboard-collection-via-selection-and-output-option-214e7e6c

title: Clipboard Data Collection via xclip (auditd Linux EXECVE)
id: d275714a-5fca-48fe-b03f-dd229f39ed6f
status: test
description: This rule flags execution of the xclip utility with arguments targeting clipboard or primary selection output (e.g., -selection/-sel with clipboard/clip) and using the -o option. Attackers may use xclip to quickly collect or exfiltrate user-accessible clipboard contents. It relies on auditd telemetry capturing process execution events (EXECVE) and the specific command-line arguments passed to xclip.
references:
  - https://linux.die.net/man/1/xclip
  - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_clipboard_collection.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-24
modified: 2022-11-26
tags:
  - attack.collection
  - attack.t1115
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: xclip
    a1:
      - -selection
      - -sel
    a2:
      - clipboard
      - clip
    a3: -o
  condition: selection
falsepositives:
  - Legitimate usage of xclip tools
level: low
license: DRL-1.1
related:
  - id: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL