Clipboard Data T1115
Tactic: Collection
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Events covered
8 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| ESF | exec | Process Execution |
| ESF | fork | Process Fork |
| Linux-Auditd | Event ID 1309 | EXECVE |
| PowerShell | Event ID 4103 | Payload Context: ContextInfo User Data: UserData. |
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
| Sysmon-for-Linux | Event ID 1 | Process Create |
Authoring guide
These 21 rules share fields, values, and exclusions.
Fields filtered most (28 distinct)
These fields appear most often in rule filters.
Top indicator values (86 distinct)
These values appear most often in rule predicates.
Exclusions (22 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Domain: Endpoint
Sigma 8 rules
- Clipboard Access Via OSAScript
- Clipboard Collection of Image Data with Xclip Tool
- Clipboard Collection with Xclip Tool
- Clipboard Collection with Xclip Tool - Auditd
- Clipboard Data Collection Via Pbpaste
- Data Copied To Clipboard Via Clip.EXE
- PowerShell Get Clipboard
- PowerShell Get-Clipboard Cmdlet Via CLI
Elastic 5 rules
- Clipboard accessed by Unsigned or Untrusted Binary
- Linux Clipboard Activity Detected
- Pbpaste Execution via Unusual Parent Process
- PowerShell Suspicious Script with Clipboard Retrieval Capabilities
- Suspicious pbpaste High Volume Activity
Splunk 7 rules
- Linux Auditd Clipboard Data Copy
- Linux Clipboard Data Copy
- Suspicious PowerShell Clipboard Activity (PowerShell)
- Suspicious PowerShell Clipboard Activity (Sysmon)
- Suspicious PowerShell Clipboard Activity (Windows Event Log)
- Windows ClipBoard Data via Get-ClipBoard
- Windows Post Exploitation Risk Behavior