Detect Clipboard Data in Microsoft Sentinel
Adversaries may collect data stored in the clipboard from users copying information within or between applications. On Windows, adversaries can read clipboard contents using PowerShell's Get-Clipboard cmdlet, the Win32 API functions OpenClipboard() and GetClipboardData(), or by invoking clip.exe in combination with scripting. macOS and Linux provide pbpaste and xclip/xsel utilities respectively. Clipboard content frequently contains high-value data including passwords copied from password managers, authentication tokens, cryptocurrency wallet addresses, PII, and internal URLs. Advanced malware such as Agent Tesla, RTM, Astaroth, CHIMNEYSWEEP, and DarkComet implement persistent clipboard monitoring loops that exfiltrate captured content, while crypto-clippers (a subclass) additionally replace clipboard content with attacker-controlled values to hijack cryptocurrency transactions.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1115 Clipboard Data
- Canonical reference
- https://attack.mitre.org/techniques/T1115/
KQL Detection Query
let ClipboardUtilities = dynamic(["clip.exe", "pbpaste", "xclip", "xsel", "xdotool"]);
let SuspiciousClipboardPatterns = dynamic([
"Get-Clipboard", "GetClipboard", "get-clipboard",
"OpenClipboard", "GetClipboardData", "EmptyClipboard",
"win32clipboard", "pyperclip", "clipboard.paste",
"xclip -o", "xclip -out", "xsel --output", "xsel -o",
"pbpaste", "System.Windows.Forms.Clipboard",
"[Windows.Forms.Clipboard]", "Clipboard.GetText",
"Clipboard::GetText", "GetOpenClipboardWindow"
]);
let SuspiciousParents = dynamic([
"winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe",
"mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe",
"rundll32.exe", "msiexec.exe", "cmd.exe", "wmic.exe",
"schtasks.exe", "at.exe"
]);
// Branch 1: Script engines and known tools accessing clipboard
let ClipboardViaScript = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe", "python.exe", "python3.exe", "wscript.exe", "cscript.exe", "mshta.exe")
| where ProcessCommandLine has_any (SuspiciousClipboardPatterns)
| extend DetectionBranch = "ScriptClipboardAccess"
| extend ClipboardMethod = case(
ProcessCommandLine has "Get-Clipboard", "PowerShell Get-Clipboard",
ProcessCommandLine has "win32clipboard" or ProcessCommandLine has "pyperclip", "Python Clipboard Module",
ProcessCommandLine has "System.Windows.Forms.Clipboard", ".NET Forms Clipboard API",
ProcessCommandLine has "OpenClipboard" or ProcessCommandLine has "GetClipboardData", "Win32 API Direct Call",
ProcessCommandLine has "xclip" or ProcessCommandLine has "xsel", "Linux Clipboard Utility",
"Unknown");
// Branch 2: Clipboard utilities spawned from suspicious parent processes
let ClipboardUtilityFromSuspiciousParent = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ (ClipboardUtilities)
| where InitiatingProcessFileName in~ (SuspiciousParents)
or InitiatingProcessFileName has_any ("python", "perl", "ruby", "node")
| extend DetectionBranch = "ClipboardUtilitySuspiciousParent"
| extend ClipboardMethod = strcat("Native Utility: ", FileName);
// Branch 3: PowerShell clipboard loop pattern (persistent monitoring)
let ClipboardMonitoringLoop = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "Get-Clipboard" and
(ProcessCommandLine has "while" or ProcessCommandLine has "Start-Sleep" or ProcessCommandLine has "loop")
| extend DetectionBranch = "ClipboardMonitoringLoop"
| extend ClipboardMethod = "Persistent Clipboard Monitor";
union ClipboardViaScript, ClipboardUtilityFromSuspiciousParent, ClipboardMonitoringLoop
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
DetectionBranch, ClipboardMethod, ProcessId, InitiatingProcessId
| sort by Timestamp descDetects clipboard data collection attempts across three detection branches using Microsoft Defender for Endpoint DeviceProcessEvents. Branch 1 identifies scripting engines (PowerShell, Python, WScript) invoking clipboard APIs or cmdlets including Get-Clipboard, System.Windows.Forms.Clipboard, win32clipboard, and pyperclip modules. Branch 2 detects native clipboard utilities (clip.exe, xclip, xsel) spawned from suspicious parent processes such as Office applications, LOLBins, or scripting engines. Branch 3 identifies persistent clipboard monitoring loops where PowerShell continuously polls the clipboard using Get-Clipboard combined with sleep/loop constructs — a pattern common in RAT implants like Agent Tesla. The ClipboardMethod field categorizes the access vector for analyst triage.
Data Sources
Required Tables
False Positives & Tuning
- Password managers (KeePass, Bitwarden, 1Password) auto-clearing clipboard after paste using scripts or scheduled tasks
- Remote Desktop Protocol (RDP) and virtual desktop infrastructure (VDI) clipboard synchronization agents running as background services
- Legitimate clipboard manager utilities (Ditto, ClipX, CopyQ, Paste) that monitor and log clipboard history for productivity
- Accessibility software and screen readers (NVDA, JAWS, Windows Narrator) that access clipboard content for reading aloud
- Development and testing automation frameworks (Selenium, AutoHotkey, PyAutoGUI) using clipboard for UI automation workflows
- Help desk and IT tools that read clipboard content for ticketing or remote assistance purposes
Other platforms for T1115
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1PowerShell Clipboard Harvest via Get-Clipboard
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Clipboard'. Sysmon Event ID 11: File Create for %TEMP%\df00tech-clip-test.txt. PowerShell ScriptBlock Log Event ID 4104 showing the full Get-Clipboard invocation. Security Event ID 4688 if command line auditing is enabled.
- Test 2PowerShell Persistent Clipboard Monitoring Loop
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'Get-Clipboard', 'while', 'Start-Sleep', and '-WindowStyle Hidden'. PowerShell ScriptBlock Log Event ID 4104 showing the full loop. Sysmon Event ID 11: File Create and multiple File Modify events for the staging file. Multiple writes to the staging file visible in DeviceFileEvents.
- Test 3Python Clipboard Theft via win32clipboard
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'win32clipboard', 'OpenClipboard', and 'GetClipboardData'. Security Event ID 4688 if command line auditing is enabled. Note: requires pywin32 package installed (pip install pywin32).
- Test 4Linux Clipboard Exfiltration via xclip
Expected signal: Auditd syscall log with EXECVE for xclip with arguments '-selection clipboard -o'. Syslog process creation event for xclip. File creation event for /tmp/df00tech-clipboard-capture.txt. If Sysmon for Linux is deployed: EventCode=1 with Image=/usr/bin/xclip.
- Test 5macOS Clipboard Collection via pbpaste
Expected signal: macOS Unified Log (ULS): process creation for pbpaste with arguments. File creation for /tmp/df00tech-clipboard-macos.txt. If Jamf or similar MDM telemetry is deployed, process execution event with parent shell context. ESF (Endpoint Security Framework) events if EDR is deployed.
References (10)
- https://attack.mitre.org/techniques/T1115/
- https://msdn.microsoft.com/en-us/library/ms649012
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
- https://www.cisa.gov/uscert/ncas/alerts/aa21-200b
- https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems
- https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1115/T1115.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows
- https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant
Unlock Pro Content
Get the full detection package for T1115 including response playbook, investigation guide, and atomic red team tests.