Clipboard accessed by Unsigned or Untrusted Binary

[rule]
description = """
Detects when an unsigned or untrusted binary attempts to access the Pasteboard XPC service in order to collect Clipboard
data. Threat actors will monitor the clipboard or collect its contents in order to gain access to sensitive information
such as passwords and seedphrases.
"""
id = "71ebb1e8-8089-4843-bdd7-8ae992c7df93"
license = "Elastic License v2"
name = "Clipboard accessed by Unsigned or Untrusted Binary"
os_list = ["macos"]
reference = [
    "https://github.com/MythicAgents/poseidon/blob/master/Payload_Type/poseidon/poseidon/agentfunctions/clipboard.go",
    "https://github.com/MythicAgents/poseidon/blob/master/Payload_Type/poseidon/poseidon/agentfunctions/clipboard_monitor.go",
]
version = "1.0.3"

query = '''
sequence by process.entity_id with maxspan=10s
[process where event.type == "start" and event.action == "fork" and process.name == "launchd" and 
  process.args like "xpcproxy" and process.args like "com.apple.pasteboard*" and 
  process.args_count == 2]
[process where event.type == "start" and event.action == "exec" and 
  (process.code_signature.trusted == false or process.code_signature.exists == false)]
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1115"
name = "Clipboard Data"
reference = "https://attack.mitre.org/techniques/T1115/"


[threat.tactic]
id = "TA0009"
name = "Collection"
reference = "https://attack.mitre.org/tactics/TA0009/"

[internal]
min_endpoint_version = "8.11.0"