Possible Clipboard Collection with Xclip Utility (via process_creation)

title: Possible Clipboard Collection with Xclip Utility (via process_creation)
id: ac61d004-6829-575c-b4d7-0aa9e6f8b910
status: stable
description: This rule detects attempts to collect data stored in the clipboard from users with the use of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high use of clipboard utilities on user workstations.
references:
    - https://attack.mitre.org/techniques/T1115/
    - https://www.packetlabs.net/posts/clipboard-data-security/
author: Huntrule Team
date: 2026-03-12
tags:
    - attack.collection
    - attack.t1115
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        Image|contains: 'xclip'
        CommandLine|contains|all:
            - '-sel'
            - 'clip'
            - '-o'
    condition: selection
falsepositives:
    - Unknown
level: low