Clipboard Data Collection with Xclip Tool
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule is particularly relevant for servers, where legitimate usage of clipboard utilities is less common than on user workstations. The rule specifically looks for the execution of 'xclip' with parameters '-sel', 'clip', and '-o', which are used to output the contents of the clipboard.
Sigma
