{"id":"T1115","name":"Clipboard Data","url":"https://attack.mitre.org/techniques/T1115","tactics":["collection"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0341","stix_id":"x-mitre-detection-strategy--461e3a2b-2315-4550-abb4-0bd73b0ceaa6","name":"Clipboard Data Access with Anomalous Context","url":"https://attack.mitre.org/detectionstrategies/DET0341","analytics":[{"id":"AN0965","stix_id":"x-mitre-analytic--48e4aceb-38dd-4bf2-8074-9fee8436985b","name":"Analytic 0965","description":"Detection of clipboard access via OS utilities (e.g., clip.exe, Get-Clipboard) by non-interactive or abnormal parent processes, potentially chained with staging or exfiltration commands.","url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0965","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Defines how far back to look for parent-child relationships and follow-on network activity."},{"field":"UserContext","description":"Filters based on service vs interactive users to reduce noise."},{"field":"ParentProcessName","description":"Tunable list of expected/benign clipboard accessors."}],"live":true,"detection_strategies":["DET0341"],"techniques":["T1115"]},{"id":"AN0966","stix_id":"x-mitre-analytic--38252d77-0b46-4e00-8732-3ce1f8491472","name":"Analytic 0966","description":"Detection of pbpaste/pbcopy clipboard access by processes without terminal sessions or linked to launch agents, potentially staged for collection.","url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0966","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"process","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"ExecutionChainLength","description":"How many chained or embedded processes to track for correlation."},{"field":"TerminalSession","description":"Whether the pbpaste/pbcopy action is tied to a user terminal."},{"field":"BinaryPath","description":"Adjust if clipboard tooling is relocated (e.g., /opt/empyre/pbpaste)."}],"live":true,"detection_strategies":["DET0341"],"techniques":["T1115"]},{"id":"AN0967","stix_id":"x-mitre-analytic--ab9a4c72-f7ce-4721-8c9f-c5d9c966b600","name":"Analytic 0967","description":"Detection of xclip or xsel access to clipboard buffers outside of user terminal context, especially when chained to staging (gzip, base64) or network exfiltration (curl, scp).","url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0967","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"ClipboardCommand","description":"Tool used (xclip, xsel, custom clipboard-read binary)."},{"field":"CorrelationWindow","description":"Temporal window to chain staging or network activity with clipboard access."},{"field":"TTYLinked","description":"Was access linked to interactive user TTY?"}],"live":true,"detection_strategies":["DET0341"],"techniques":["T1115"]}],"live":true,"version":"1.0","techniques":["T1115"]}],"sigma_rules":[{"id":"214e7e6c-f21b-47ff-bb6f-551b2d143fcf","title":"Clipboard Collection with Xclip Tool - Auditd","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-24","modified":"2022-11-26","description":"Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool.\nXclip has to be installed.\nHighly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.\n","references":["https://linux.die.net/man/1/xclip","https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.collection","attack.t1115"],"path":"rules/linux/auditd/execve/lnx_auditd_clipboard_collection.yml","techniques":["T1115"],"cves":[]},{"id":"4cbd4f12-2e22-43e3-882f-bff3247ffb78","title":"PowerShell Get Clipboard","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-05-02","modified":"2023-01-04","description":"A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/16","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.collection","attack.t1115"],"path":"rules/windows/powershell/powershell_module/posh_pm_get_clipboard.yml","techniques":["T1115"],"cves":[]},{"id":"7794fa3c-edea-4cff-bec7-267dd4770fd7","title":"Clipboard Access Via OSAScript","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-01-31","modified":"2026-05-22","description":"Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts","references":["https://www.sentinelone.com/blog/how-offensive-actors-use-applescript-for-attacking-macos/"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.collection","attack.execution","attack.t1115","attack.t1059.002"],"path":"rules/macos/process_creation/proc_creation_macos_clipboard_access_via_osascript.yml","techniques":["T1115","T1059.002"],"cves":[]},{"id":"b9aeac14-2ffd-4ad3-b967-1354a4e628c3","title":"PowerShell Get-Clipboard Cmdlet Via CLI","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-05-02","modified":"2022-12-25","description":"Detects usage of the 'Get-Clipboard' cmdlet via CLI","references":["https://github.com/OTRF/detection-hackathon-apt29/issues/16","https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1115"],"path":"rules/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml","techniques":["T1115"],"cves":[]},{"id":"d8af0da1-2959-40f9-a3e4-37a6aa1228b7","title":"Clipboard Data Collection Via Pbpaste","author":"Daniel Cortez","status":"test","level":"medium","date":"2024-07-30","modified":null,"description":"Detects execution of the \"pbpaste\" utility, which retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout).\nThe utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands.\nIt can also be used in shell scripts that may require clipboard content as input.\nAttackers can abuse this utility in order to collect data from the user clipboard, which may contain passwords or sensitive information.\nUse this rule to hunt for potential abuse of the utility by looking at the parent process and any potentially suspicious command line content.\n","references":["https://www.loobins.io/binaries/pbpaste/","https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b","https://media.defense.gov/2021/Jul/19/2002805003/-1/-1/1/CSA_CHINESE_STATE-SPONSORED_CYBER_TTPS.PDF"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.collection","attack.credential-access","attack.t1115","detection.threat-hunting"],"path":"rules-threat-hunting/macos/process_creation/proc_creation_macos_pbpaste_execution.yml","techniques":["T1115"],"cves":[]},{"id":"ddeff553-5233-4ae9-bbab-d64d2bd634be","title":"Data Copied To Clipboard Via Clip.EXE","author":"frack113","status":"test","level":"low","date":"2021-07-27","modified":"2023-02-21","description":"Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.","references":["https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.t1115"],"path":"rules/windows/process_creation/proc_creation_win_clip_execution.yml","techniques":["T1115"],"cves":[]},{"id":"ec127035-a636-4b9a-8555-0efd4e59f316","title":"Clipboard Collection with Xclip Tool","author":"Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","status":"test","level":"low","date":"2021-10-15","modified":"2022-09-15","description":"Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.\nHighly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.\n","references":["https://www.packetlabs.net/posts/clipboard-data-security/"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.collection","attack.t1115"],"path":"rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml","techniques":["T1115"],"cves":[]},{"id":"f200dc3f-b219-425d-a17e-c38467364816","title":"Clipboard Collection of Image Data with Xclip Tool","author":"Pawel Mazur","status":"test","level":"low","date":"2021-10-01","modified":"2022-10-09","description":"Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool.\nXclip has to be installed.\nHighly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.\n","references":["https://linux.die.net/man/1/xclip"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.collection","attack.t1115"],"path":"rules/linux/auditd/execve/lnx_auditd_clipboard_image_collection.yml","techniques":["T1115"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}