Detect Clipboard Data in Google Chronicle

rule t1115_clipboard_data_collection {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects clipboard data collection via scripting engine API abuse, native clipboard utilities launched from suspicious parent processes, and persistent clipboard monitoring loops (MITRE ATT&CK T1115)"
    mitre_attack_tactic = "Collection"
    mitre_attack_technique = "T1115"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"
    created = "2026-04-18"

  events:
    (
      // Branch 1: Script engines invoking clipboard APIs
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and (
          re.regex($e.principal.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe|python[0-9]*\.exe|wscript\.exe|cscript\.exe|mshta\.exe|perl\.exe|ruby\.exe|node\.exe)$`)
        )
        and (
          re.regex($e.principal.process.command_line, `(?i)(get-clipboard|getclipboard|openclipboard|getclipboarddata|win32clipboard|pyperclip|clipboard\.paste|system\.windows\.forms\.clipboard|clipboard::gettext|clipboard\.gettext|getopencl ipboardwindow)`)
        )
      )
      or
      // Branch 2: Native clipboard utilities from suspicious parents
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.principal.process.file.full_path, `(?i)(clip\.exe|xclip|xsel|xdotool|pbpaste)$`)
        and re.regex($e.principal.process.parent_process.file.full_path, `(?i)(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mshta\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|rundll32\.exe|msiexec\.exe|python[0-9]*\.exe|perl\.exe|ruby\.exe|node\.exe)$`)
      )
      or
      // Branch 3: Clipboard monitoring loop pattern
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.principal.process.file.full_path, `(?i)(powershell\.exe|pwsh\.exe)$`)
        and re.regex($e.principal.process.command_line, `(?i)get-clipboard`)
        and re.regex($e.principal.process.command_line, `(?i)(while|start-sleep|foreach|-loop)`)
      )
    )

  condition:
    $e
}