Clipboard Data Collection Via Pbpaste

A Sigma rule for process creation on macOS, from SigmaHQ’s threat hunting rules, by Daniel Cortez.

medium 1 ATT&CK technique 1 program it names 2 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    Image|endswith: '/pbpaste'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Daniel Cortez, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Write the contents of the clipboard to a file on the page for pbpaste

pbpaste >path/to/fileIdentify

Use the contents of the clipboard as input to a command on the page for pbpaste

pbpaste | grep search_stringIdentify

Programs and files it names

their pages here

pbpaste

ATT&CK

the techniques it is tagged with

T1115Clipboard Data

Clipboard Data Collection Via Pbpaste

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1115 Clipboard Data