Update lnx_auditd_clipboard_collection.yml

Changes after suggestion.
2024-11-06 09:25:17 +00:00 · 2021-09-27 07:59:43 +02:00 · 2021-09-27 07:59:43 +02:00 · 6a2785492d
commit 6a2785492d
parent 4bbe4962b0
1 changed files with 12 additions and 8 deletions
--- a/rules/linux/auditd/lnx_auditd_clipboard_collection.yml
+++ b/rules/linux/auditd/lnx_auditd_clipboard_collection.yml
@ -12,16 +12,20 @@ logsource:
   product: linux
   service: auditd
 detection:
-   xclip:
-       type: EXECVE
-       a0: xclip
-       a1: '-selection'
-       a2: clipboard
-       a3: '-o'
-   condition: xclip
+    xclip:
+        type: EXECVE
+        a0: xclip
+        a1: 
+            - '-selection'
+            - '-sel'
+        a2: 
+            - clipboard
+            - clip
+        a3: '-o'
+    condition: xclip
 tags:
   - attack.collection
   - attack.t1115
 falsepositives:
   - Legitimate usage of xclip tools
-level: low
+level: low