Clipboard Collection of Image Data with Xclip Tool

Title: Clipboard Collection of Image Data with Xclip Tool
Status: test
Description:Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
References:
  -https://linux.die.net/man/1/xclip
Author: Pawel Mazur
Date: 2021-10-01
modified:2022-10-09
Tags:

• -'attack.collection'
• -'attack.t1115'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'EXECVE'
    a0: 'xclip'
    a1:
      -'-selection'
      -'-sel'

    a2:
      -'clipboard'
      -'clip'

    a3: '-t'
    a4|startswith: 'image/'
    a5: '-o'
  condition:selection
Falsepositives:
  -Legitimate usage of xclip tools
Level: low