LoFP LoFP / legitimate clipboard utilities and automation scripts that read or write clipboard content

Techniques

Sample rules

Clipboard Access Via OSAScript

Description

Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts

Detection logic

condition: selection and not 1 of filter_optional_*
filter_optional_opencode:
  CommandLine|contains|all:
  - osascript
  - ' -e '
  - set imageData to the clipboard
  - set fileRef
  ParentImage|endswith: opencode
selection:
  CommandLine|contains|all:
  - ' -e '
  - clipboard
  Image|endswith: /osascript