Clipboard Data Collection Via Pbpaste on macOS
Detects the execution of the "pbpaste" utility on macOS. This utility retrieves the contents of the clipboard and writes them to standard output. Attackers can abuse this utility to collect sensitive data, such as passwords or other confidential information, from the user's clipboard. The rule is designed to hunt for potential malicious use of pbpaste by examining the parent process and command-line arguments for suspicious activity.
Sigma
