Clipboard Data Collection Via OSAScript

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•4•0•28

This rule detects attempts to collect data from the clipboard on macOS systems by executing the 'osascript' binary with arguments that indicate clipboard interaction. Specifically, it looks for command lines containing 'osascript', ' -e ', and 'clipboard'. This combination suggests an AppleScript or JavaScript for Automation (JXA) command being executed to access clipboard contents.