Cross-source coverage

T1115 / ATT&CK

Clipboard Data

23 rules · 22 families across 6 sources.

From MITRE ATT&CK 19.2

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation).

macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.

Tactics
Collection
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:Sysmonmacos:unifiedlogauditd:SYSCALL

How MITRE says to detect it DET0341

Clipboard Data Access with Anomalous Context

Windows Analytic 0965

Detection of clipboard access via OS utilities (e.g., clip.exe, Get-Clipboard) by non-interactive or abnormal parent processes, potentially chained with staging or exfiltration commands.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=10

macOS Analytic 0966

Detection of pbpaste/pbcopy clipboard access by processes without terminal sessions or linked to launch agents, potentially staged for collection.

  • macos:unifiedlog process

Linux Analytic 0967

Detection of xclip or xsel access to clipboard buffers outside of user terminal context, especially when chained to staging (gzip, base64) or network exfiltration (curl, scp).

  • auditd:SYSCALL execve

View on attack.mitre.org ↗

SigmaHQ/sigma

8 rules
Detection Severity Format
Clipboard Access Via OSAScript Medium Sigma
Clipboard Data Collection Via Pbpaste Medium Sigma
PowerShell Get Clipboard Medium Sigma
PowerShell Get-Clipboard Cmdlet Via CLI Medium Sigma
Clipboard Collection of Image Data with Xclip Tool Low Sigma
Clipboard Collection with Xclip Tool Low Sigma
Clipboard Collection with Xclip Tool - Auditd Low Sigma
Data Copied To Clipboard Via Clip.EXE Low Sigma

socfortress/Wazuh-Rules

5 rules · 4 families
Detection Severity Format
Clipboard access (xclip) detected on process exit (T1115) High Wazuh XML
Clipboard activity detected using xclip (T1115) High Wazuh XML
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. 2 variants High Wazuh XML
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. 2 variants High Wazuh XML
Sysmon - Event 24: ClipboardChange (New content in the clipboard) by · win.system.eventID = 24 Low Wazuh XML

elastic/detection-rules

4 rules
Detection Severity Format
Pbpaste Execution via Unusual Parent Process High Elastic TOML
PowerShell Suspicious Script with Clipboard Retrieval Capabilities Medium Elastic TOML
Suspicious pbpaste High Volume Activity Medium Elastic TOML
Linux Clipboard Activity Detected Low Elastic TOML

splunk/security_content

4 rules
Detection Severity Format
Linux Auditd Clipboard Data Copy Undefined SPL
Linux Clipboard Data Copy Undefined SPL
Windows ClipBoard Data via Get-ClipBoard Undefined SPL
Windows Post Exploitation Risk Behavior Undefined SPL

Wazuh Core Ruleset

1 rule
Detection Severity Format
Powershell collected clipboard data Low Wazuh XML

elastic/protections-artifacts

1 rule
Detection Severity Format
Clipboard accessed by Unsigned or Untrusted Binary Undefined Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.