Possible Clipboard Collection of Image Data with Xclip Utility (via auditd)

title: Possible Clipboard Collection of Image Data with Xclip Utility (via auditd)
id: 78d3dcb1-25d3-55a9-8e59-072140607b92
status: stable
description: This rule detects attempts to collect image data stored in the clipboard from users with the use of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high use of clipboard utilities on user workstations.
references:
    - https://attack.mitre.org/techniques/T1115/
    - https://linux.die.net/man/1/xclip
author: 'Huntrule Team'
date: 2026-07-04
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: xclip
        a1:
            - '-selection'
            - '-sel'
        a2:
            - clipboard
            - clip
        a3: '-t'
        a4|startswith: 'image/'
        a5: '-o'
    condition: selection
falsepositives:
    - Unknown
level: low