MITRE ATT&CK technique
Clipboard Data detection rulesT1115
Clipboard Data (T1115) is a MITRE ATT&CK technique in the Collection tactic. This page lists the 8 community-maintained Sigma detection rules in the library mapped to T1115 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows, linux, macos.
Tactic
Clipboard Access Via OSAScript
mediumDetects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts
macos · process_creation
Clipboard Data Collection Via Pbpaste
mediumDetects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout). The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands. It can also be used in shell scripts that may require clipboard content as input. Attackers can abuse this utility in order to collect data from the user clipboard, which may contain passwords or sensitive information. Use this rule to hunt for potential abuse of the utility by looking at the parent process and any potentially suspicious command line content.
macos · process_creation
PowerShell Get Clipboard
mediumA General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.
windows · ps_module
PowerShell Get-Clipboard Cmdlet Via CLI
mediumDetects usage of the 'Get-Clipboard' cmdlet via CLI
windows · process_creation
Clipboard Collection of Image Data with Xclip Tool
lowDetects attempts to collect image data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
linux
Clipboard Collection with Xclip Tool
lowDetects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
linux · process_creation
Clipboard Collection with Xclip Tool - Auditd
lowDetects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
linux
Data Copied To Clipboard Via Clip.EXE
lowDetects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.
windows · process_creation