Sigma rule: Clipboard Data Collection Via Pbpaste

Rule

Title

Clipboard Data Collection Via Pbpaste

Status

test

Level

medium

Author

Daniel Cortez

Date

2024-07-30

File

rules-threat-hunting/macos/process_creation/proc_creation_macos_pbpaste_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout).
The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands.
It can also be used in shell scripts that may require clipboard content as input.
Attackers can abuse this utility in order to collect data from the user clipboard, which may contain passwords or sensitive information.
Use this rule to hunt for potential abuse of the utility by looking at the parent process and any potentially suspicious command line content.

Log source

product

macos

category

process_creation

Detection

selection:
    Image|endswith: '/pbpaste'
condition: selection

False positives (as the rule lists them)

• Legitimate administration activities

Tags

• attack.collection
• attack.credential-access
• attack.t1115
• detection.threat-hunting

MITRE ATT&CK ids this rule names

• T1115

References

• https://www.loobins.io/binaries/pbpaste/
• https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b
• https://media.defense.gov/2021/Jul/19/2002805003/-1/-1/1/CSA_CHINESE_STATE-SPONSORED_CYBER_TTPS.PDF

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-threat-hunting/macos/process_creation/proc_creation_macos_pbpaste_execution.yml