macOS: Clipboard data collection via pbpaste command execution

Flags macOS executions of pbpaste that can expose clipboard contents to stdout for potential data collection.

FreeUnreviewedSigmamediumv1

macos-clipboard-data-collection-via-pbpaste-command-execution-d8af0da1

title: "macOS: Clipboard data collection via pbpaste command execution"
id: d18e99df-24f2-47f6-bf4e-eba15342cb82
status: test
description: This rule matches process creation events where the executable path ends with '/pbpaste'. The pbpaste utility outputs the current macOS pasteboard (clipboard) contents to standard output, which can be used to capture sensitive user data. The behavior matters because clipboard contents may include credentials or other sensitive information, and attackers can chain the output to other commands or scripts. Telemetry relies on process execution records including the executed image path.
references:
  - https://www.loobins.io/binaries/pbpaste/
  - https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b
  - https://media.defense.gov/2021/Jul/19/2002805003/-1/-1/1/CSA_CHINESE_STATE-SPONSORED_CYBER_TTPS.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/macos/process_creation/proc_creation_macos_pbpaste_execution.yml
author: Daniel Cortez, Huntrule Team
date: 2024-07-30
tags:
  - attack.collection
  - attack.credential-access
  - attack.t1115
  - detection.threat-hunting
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /pbpaste
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: d8af0da1-2959-40f9-a3e4-37a6aa1228b7
    type: derived

What it detects

This rule matches process creation events where the executable path ends with '/pbpaste'. The pbpaste utility outputs the current macOS pasteboard (clipboard) contents to standard output, which can be used to capture sensitive user data. The behavior matters because clipboard contents may include credentials or other sensitive information, and attackers can chain the output to other commands or scripts. Telemetry relies on process execution records including the executed image path.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.