Possible Clipboard Collection with Xclip Utility - Auditd (via auditd)

title: Possible Clipboard Collection with Xclip Utility - Auditd (via auditd)
id: c1543177-0d78-5355-b541-fff906b58e72
status: stable
description: This rule detects attempts to collect data stored in the clipboard from users with the use of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high use of clipboard utilities on user workstations.
references:
    - https://attack.mitre.org/techniques/T1115/
    - https://linux.die.net/man/1/xclip
    - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
author: 'Huntrule Team'
date: 2026-05-07
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: EXECVE
        a0: xclip
        a1:
            - '-selection'
            - '-sel'
        a2:
            - clipboard
            - clip
        a3: '-o'
    condition: selection
falsepositives:
    - Unknown
level: low