Linux clipboard image data collection via xclip

Flags xclip usage that outputs image/* data from the clipboard on Linux.

FreeUnreviewedSigmalowv1

linux-clipboard-image-data-collection-via-xclip-f200dc3f

title: Linux clipboard image data collection via xclip
id: a51ee099-2c43-41f2-a759-9550a906804d
status: test
description: This rule identifies execution of the xclip utility on Linux where clipboard or clip selection is used to output data with a MIME type starting with image/ (e.g., image/*). Attackers may use this to capture or extract image content from a user’s clipboard for collection or exfiltration. Telemetry relies on Linux auditd execve events capturing the xclip command-line arguments.
references:
  - https://linux.die.net/man/1/xclip
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_clipboard_image_collection.yml
author: Pawel Mazur, Huntrule Team
date: 2021-10-01
modified: 2022-10-09
tags:
  - attack.collection
  - attack.t1115
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    a0: xclip
    a1:
      - -selection
      - -sel
    a2:
      - clipboard
      - clip
    a3: -t
    a4|startswith: image/
    a5: -o
  condition: selection
falsepositives:
  - Legitimate usage of xclip tools
level: low
license: DRL-1.1
related:
  - id: f200dc3f-b219-425d-a17e-c38467364816
    type: derived

What it detects

This rule identifies execution of the xclip utility on Linux where clipboard or clip selection is used to output data with a MIME type starting with image/ (e.g., image/*). Attackers may use this to capture or extract image content from a user’s clipboard for collection or exfiltration. Telemetry relies on Linux auditd execve events capturing the xclip command-line arguments.

Known false positives

Legitimate usage of xclip tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.