Linux Clipboard Data Collection via xclip -sel clip -o

ATT&CK techniques

Collection

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
- T1115Clipboard Data
C2
Exfiltration
Impact

What it detects

This rule flags process executions on Linux where the command line uses xclip with parameters that request clipboard contents (selection and output to standard output). Attackers commonly harvest clipboard data to capture sensitive text copied by users. The detection relies on Linux process creation telemetry, matching the xclip executable name and the presence of the -sel, clip, and -o options in the command line.

Reporting behind it

Related detections9 linkedT1115 — drag to rearrange

Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)

Possible Clipboard Data Capture via PowerShell (via process_creation)

macOS pbpaste Clipboard Read via Process Execution

macOS osascript Clipboard Access via AppleScript Commands

Linux xclip Clipboard Image Collection via Image MIME Types

Clipboard Data Collection via xclip (auditd Linux EXECVE)

Windows: clip.exe Execution to Copy Data to Clipboard

Windows PowerShell Get-Clipboard Command Execution

PowerShell Get-Clipboard Cmdlet Execution via CLI on Windows

Linux Clipboard Data Collection via xclip -sel clip -o

Pivot detection · T1115 · 9 related

Changelog

v3

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-clipboard-collection-via-xclip-with-select-clip-output-sel-clip-o-ec127035

title: Linux Clipboard Data Collection via xclip -sel clip -o
id: b35832fb-0257-46fe-9fb8-55db34026e9b
status: test
description: This rule flags process executions on Linux where the command line uses xclip with parameters that request clipboard contents (selection and output to standard output). Attackers commonly harvest clipboard data to capture sensitive text copied by users. The detection relies on Linux process creation telemetry, matching the xclip executable name and the presence of the -sel, clip, and -o options in the command line.
references:
  - https://www.packetlabs.net/posts/clipboard-data-security/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml
author: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC, Huntrule Team
date: 2021-10-15
modified: 2022-09-15
tags:
  - attack.collection
  - attack.t1115
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|contains: xclip
    CommandLine|contains|all:
      - -sel
      - clip
      - -o
  condition: selection
falsepositives:
  - Legitimate usage of xclip tools.
level: low
license: DRL-1.1
related:
  - id: ec127035-a636-4b9a-8555-0efd4e59f316
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL