Elastic low stable kql

Linux Clipboard Activity Detected

This rule monitors for the usage of the most common clipboard utilities on unix systems by an uncommon process parent. Adversaries may collect data stored in the clipboard from users copying information within or between applications.

View Source

Detection Logic

event.category:process and host.os.type:"linux" and event.type:"start" and
event.action:("exec" or "exec_event" or "executed" or "process_started" or "start") and
process.name:("xclip" or "xsel" or "wl-clipboard" or "clipman" or "copyq" or "pbcopy" or "wl-copy") and
not process.parent.name:("bwrap" or "micro")

Field Validations

Loading…

Comments (0)

Loading comments...