Clipboard Collection with Xclip Tool - Auditd
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for the execution of 'xclip' with arguments indicating clipboard selection and output. It is highly recommended for server environments due to the frequent legitimate use of clipboard utilities on user workstations.
Sigma
