Techniques › T1115
T1115 Clipboard Data
collection — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
8
Sigma rules tagged attack.t1115
0
KEV CVEs mapped here
<p>Adversaries may collect data stored in the clipboard from users copying information within or between applications.</p><p>For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation).</p><p>macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0341 Clipboard Data Access with Anomalous Context v1.0
AN0965 WindowsDetection of clipboard access via OS utilities (e.g., clip.exe, Get-Clipboard) by non-interactive or abnormal parent processes, potentially chained with staging or exfiltration commands.Tunable:
TimeWindowUserContextParentProcessNameAN0966 macOSDetection of pbpaste/pbcopy clipboard access by processes without terminal sessions or linked to launch agents, potentially staged for collection.Tunable:ExecutionChainLengthTerminalSessionBinaryPathAN0967 LinuxDetection of xclip or xsel access to clipboard buffers outside of user terminal context, especially when chained to staging (gzip, base64) or network exfiltration (curl, scp).Tunable:ClipboardCommandCorrelationWindowTTYLinked
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1115
Author: Pawel Mazur
· 2021-09-24 (modified 2022-11-26) · logsource: product=linux service=auditd · 214e7e6c-f21b-47ff-bb6f-551b2d143fcf
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool.
Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-05-02 (modified 2023-01-04) · logsource: product=windows category=ps_module · 4cbd4f12-2e22-43e3-882f-bff3247ffb78
A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.
Author: Sohan G (D4rkCiph3r)
· 2023-01-31 (modified 2026-05-22) · logsource: product=macos category=process_creation · 7794fa3c-edea-4cff-bec7-267dd4770fd7
Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts
Author: Nasreddine Bencherchali (Nextron Systems)
· 2020-05-02 (modified 2022-12-25) · logsource: product=windows category=process_creation · b9aeac14-2ffd-4ad3-b967-1354a4e628c3
Detects usage of the 'Get-Clipboard' cmdlet via CLI
Author: Daniel Cortez
· 2024-07-30 · logsource: product=macos category=process_creation · d8af0da1-2959-40f9-a3e4-37a6aa1228b7
Detects execution of the "pbpaste" utility, which retrieves the contents of the clipboard (a.k.a. pasteboard) and writes them to the standard output (stdout).
The utility is often used for creating new files with the clipboard content or for piping clipboard contents to other commands.
It can also be used in shell scripts that may require clipboard content as input.
Attackers can abuse this utility in order to collect data from the user clipboard, which may contain passwords or sensitive information.
Use this rule to hunt for potential abuse of the utility by looking at the parent process and any potentially suspicious command line content.
Author: frack113
· 2021-07-27 (modified 2023-02-21) · logsource: product=windows category=process_creation · ddeff553-5233-4ae9-bbab-d64d2bd634be
Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Author: Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-09-15) · logsource: product=linux category=process_creation · ec127035-a636-4b9a-8555-0efd4e59f316
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Author: Pawel Mazur
· 2021-10-01 (modified 2022-10-09) · logsource: product=linux service=auditd · f200dc3f-b219-425d-a17e-c38467364816
Detects attempts to collect image data stored in the clipboard from users with the usage of xclip tool.
Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.