Linux xclip Clipboard Image Collection via Image MIME Types
Flags xclip usage that outputs image/* data from the clipboard on Linux.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2021-10-01
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of the xclip tool to read image data from the clipboard by using the -t option with an image/* MIME type and outputting the clipboard contents. Collecting clipboard image data can enable attackers to capture sensitive visual information copied by a user. The detection relies on Linux auditd EXECVE telemetry capturing the xclip command-line arguments, specifically the -selection/-sel selection mode, the targeted image MIME type, and the -o output flag.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux xclip Clipboard Image Collection via Image MIME Types
id: a51ee099-2c43-41f2-a759-9550a906804d
status: test
description: This rule identifies execution of the xclip tool to read image data from the clipboard by using the -t option with an image/* MIME type and outputting the clipboard contents. Collecting clipboard image data can enable attackers to capture sensitive visual information copied by a user. The detection relies on Linux auditd EXECVE telemetry capturing the xclip command-line arguments, specifically the -selection/-sel selection mode, the targeted image MIME type, and the -o output flag.
references:
- https://linux.die.net/man/1/xclip
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_clipboard_image_collection.yml
author: Pawel Mazur, Huntrule Team
date: 2021-10-01
modified: 2022-10-09
tags:
- attack.collection
- attack.t1115
logsource:
product: linux
service: auditd
detection:
selection:
type: EXECVE
a0: xclip
a1:
- -selection
- -sel
a2:
- clipboard
- clip
a3: -t
a4|startswith: image/
a5: -o
condition: selection
falsepositives:
- Legitimate usage of xclip tools
level: low
license: DRL-1.1
related:
- id: f200dc3f-b219-425d-a17e-c38467364816
type: derived