Linux Clipboard Collection via xclip with Select Clip Output (-sel clip -o)

Alerts on Linux processes running xclip to output clipboard content using -sel clip -o.

FreeUnreviewedSigmalowv1

linux-clipboard-collection-via-xclip-with-select-clip-output-sel-clip-o-ec127035

title: Linux Clipboard Collection via xclip with Select Clip Output (-sel clip -o)
id: b35832fb-0257-46fe-9fb8-55db34026e9b
status: test
description: This rule flags process creation events where the command line invokes the xclip utility to output data from the clipboard selection. Attackers commonly use clipboard collection to capture user-provided content such as copied text or other sensitive data. The detection relies on Linux process creation telemetry and matches command-line arguments indicating selection ('-sel clip') and output ('-o') along with the presence of 'xclip' in the process image.
references:
  - https://www.packetlabs.net/posts/clipboard-data-security/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml
author: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-10-15
modified: 2022-09-15
tags:
  - attack.collection
  - attack.t1115
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|contains: xclip
    CommandLine|contains|all:
      - -sel
      - clip
      - -o
  condition: selection
falsepositives:
  - Legitimate usage of xclip tools.
level: low
license: DRL-1.1
related:
  - id: ec127035-a636-4b9a-8555-0efd4e59f316
    type: derived

What it detects

This rule flags process creation events where the command line invokes the xclip utility to output data from the clipboard selection. Attackers commonly use clipboard collection to capture user-provided content such as copied text or other sensitive data. The detection relies on Linux process creation telemetry and matches command-line arguments indicating selection ('-sel clip') and output ('-o') along with the presence of 'xclip' in the process image.

Known false positives

Legitimate usage of xclip tools.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.