Detect Clipboard Data in Sumo Logic CSE
Adversaries may collect data stored in the clipboard from users copying information within or between applications. On Windows, adversaries can read clipboard contents using PowerShell's Get-Clipboard cmdlet, the Win32 API functions OpenClipboard() and GetClipboardData(), or by invoking clip.exe in combination with scripting. macOS and Linux provide pbpaste and xclip/xsel utilities respectively. Clipboard content frequently contains high-value data including passwords copied from password managers, authentication tokens, cryptocurrency wallet addresses, PII, and internal URLs. Advanced malware such as Agent Tesla, RTM, Astaroth, CHIMNEYSWEEP, and DarkComet implement persistent clipboard monitoring loops that exfiltrate captured content, while crypto-clippers (a subclass) additionally replace clipboard content with attacker-controlled values to hijack cryptocurrency transactions.
MITRE ATT&CK
- Tactic
- Collection
- Technique
- T1115 Clipboard Data
- Canonical reference
- https://attack.mitre.org/techniques/T1115/
Sumo Detection Query
_sourceCategory="*windows*sysmon*" OR _sourceCategory="*endpoint*process*"
| json auto
| where EventID = "1" OR event_id = "1"
| eval image = lower(Image)
| eval cmdline = lower(CommandLine)
| eval parent = lower(ParentImage)
// Branch 1: Script engines using clipboard APIs
| eval is_script_engine = if(image matches "/(powershell\.exe|pwsh\.exe|python[0-9]*\.exe|wscript\.exe|cscript\.exe|mshta\.exe|perl\.exe|ruby\.exe|node\.exe)$/", 1, 0)
| eval has_clipboard_api = if(cmdline matches "/(get-clipboard|getclipboard|openclipboard|getclipboarddata|win32clipboard|pyperclip|clipboard\.paste|system\.windows\.forms\.clipboard|clipboard::gettext|clipboard\.gettext|getopencl ipboardwindow)/", 1, 0)
// Branch 2: Native clipboard utilities from suspicious parents
| eval is_clip_util = if(image matches "/(clip\.exe|xclip|xsel|xdotool|pbpaste)$/", 1, 0)
| eval suspicious_parent = if(parent matches "/(winword\.exe|excel\.exe|powerpnt\.exe|outlook\.exe|mshta\.exe|wscript\.exe|cscript\.exe|regsvr32\.exe|rundll32\.exe|msiexec\.exe|python[0-9]*\.exe|perl\.exe|ruby\.exe|node\.exe)/", 1, 0)
// Branch 3: Clipboard monitoring loop
| eval is_clipboard_loop = if((cmdline matches "/get-clipboard/") AND (cmdline matches "/(while|start-sleep|foreach|-loop)/"), 1, 0)
// Scoring
| eval clipboard_score = has_clipboard_api + is_clip_util + is_clipboard_loop
| eval suspicion_score = clipboard_score
+ if(is_script_engine = 1 AND has_clipboard_api = 1, 1, 0)
+ if(is_clip_util = 1 AND suspicious_parent = 1, 1, 0)
+ if(is_clipboard_loop = 1, 2, 0)
| where suspicion_score > 0
| eval detection_branch = if(is_clipboard_loop = 1, "ClipboardMonitoringLoop",
if(is_script_engine = 1 AND has_clipboard_api = 1, "ScriptClipboardAccess",
if(is_clip_util = 1 AND suspicious_parent = 1, "ClipboardUtilitySuspiciousParent",
"Informational")))
| fields _messageTime, ComputerName, User, Image, CommandLine, ParentImage, ParentCommandLine, detection_branch, has_clipboard_api, is_clip_util, is_clipboard_loop, suspicion_score
| sort by suspicion_score desc, _messageTime descSumo Logic CSE query targeting Sysmon process creation events (EventID 1) to detect clipboard data theft across three behavioral branches: scripting engines calling clipboard APIs, native clipboard utilities spawned from suspicious parents, and persistent clipboard monitoring loops. Outputs a suspicion score and detection branch for analyst triage.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate clipboard manager applications (e.g., Ditto, ClipboardFusion) that use system APIs to monitor and persist clipboard history on user workstations
- Accessibility software and screen readers that access clipboard content as part of assistive technology workflows
- Enterprise endpoint management agents or MDM tools that run PowerShell clipboard operations during provisioning or configuration management tasks
Other platforms for T1115
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 PowerShell Clipboard Harvest via Get-Clipboard
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Clipboard'. Sysmon Event ID 11: File Create for %TEMP%\df00tech-clip-test.txt. PowerShell ScriptBlock Log Event ID 4104 showing the full Get-Clipboard invocation. Security Event ID 4688 if command line auditing is enabled.
- Test 2 PowerShell Persistent Clipboard Monitoring Loop
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'Get-Clipboard', 'while', 'Start-Sleep', and '-WindowStyle Hidden'. PowerShell ScriptBlock Log Event ID 4104 showing the full loop. Sysmon Event ID 11: File Create and multiple File Modify events for the staging file. Multiple writes to the staging file visible in DeviceFileEvents.
- Test 3 Python Clipboard Theft via win32clipboard
Expected signal: Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'win32clipboard', 'OpenClipboard', and 'GetClipboardData'. Security Event ID 4688 if command line auditing is enabled. Note: requires pywin32 package installed (pip install pywin32).
- Test 4 Linux Clipboard Exfiltration via xclip
Expected signal: Auditd syscall log with EXECVE for xclip with arguments '-selection clipboard -o'. Syslog process creation event for xclip. File creation event for /tmp/df00tech-clipboard-capture.txt. If Sysmon for Linux is deployed: EventCode=1 with Image=/usr/bin/xclip.
- Test 5 macOS Clipboard Collection via pbpaste
Expected signal: macOS Unified Log (ULS): process creation for pbpaste with arguments. File creation for /tmp/df00tech-clipboard-macos.txt. If Jamf or similar MDM telemetry is deployed, process execution event with parent shell context. ESF (Endpoint Security Framework) events if EDR is deployed.
References (9)
- https://attack.mitre.org/techniques/T1115/
- https://msdn.microsoft.com/en-us/library/ms649012
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
- https://www.cisa.gov/uscert/ncas/alerts/aa21-200b
- https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems
- https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1115/T1115.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows
- https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant
Response Playbook
Triage
- Identify the accessing process — is it a known legitimate application (password manager, clipboard manager, RDP agent) or an unexpected process such as a scripting engine, LOLBin, or untrusted executable? Check the binary's hash against threat intelligence.
- Examine the parent process chain — was the clipboard-accessing process spawned by an Office document, a downloaded file, a browser download, or an email attachment? Parent-child relationships through Office applications or mshta.exe are high-confidence indicators of phishing-delivered malware.
- Assess timing context — did the clipboard access occur immediately after the user performed a copy action (expected) or at regular intervals suggesting automated monitoring? Persistent loops polling the clipboard every few seconds are a strong RAT indicator.
- Review process execution path — is the binary running from a suspicious location such as %TEMP%, %APPDATA%, ProgramData, or a user-writable directory? Legitimate clipboard utilities reside in System32 or Program Files.
- Check for outbound network connections from the same process within the investigation window — clipboard-stealing malware typically exfiltrates captured data immediately via HTTP/HTTPS, SMTP, or FTP to C2 infrastructure. Correlate with DeviceNetworkEvents or Sysmon Event ID 3.
- Determine what was likely in the clipboard at the time — review the user's recent activity (open applications, browser history, recent file access) to assess whether high-value data such as credentials, financial information, or cryptographic keys may have been exposed.
- Check for cryptocurrency-related activity on the host — crypto-clippers actively monitor for wallet address patterns in the clipboard and replace them. Look for browser extensions, recent downloads, or crypto wallet applications that may indicate the user's clipboard was targeted for transaction hijacking.
Containment
- If active C2 communication is detected from the clipboard-accessing process: isolate the endpoint immediately using EDR network isolation or emergency VLAN change to prevent further data exfiltration.
- If the user copied credentials, tokens, or sensitive data before the theft was detected: immediately rotate all potentially compromised credentials, revoke active sessions and tokens, and notify the affected user and data owner.
- If cryptocurrency wallet addresses were in the clipboard (potential crypto-clipper): alert the user immediately — any pending transactions may have had destination addresses replaced, and funds cannot be recovered once sent.
- Terminate the malicious process and quarantine the associated binary. Collect a memory dump before termination if possible to recover exfiltrated clipboard contents and C2 configuration from process memory.
- If the infection vector was a phishing email or malicious document: block the sender domain, quarantine similar emails from the past 30 days across the mail gateway, and notify security awareness training programs.
- If persistence mechanisms are identified (scheduled task, registry run key, startup folder): remove the persistence entry before reimaging to prevent reinfection from surviving artifacts.
Evidence Collection
- Process creation logs — Sysmon Event ID 1 or Security Event ID 4688 (with command line auditing enabled) for the clipboard-accessing process and its full parent chain, including timestamps and command line arguments.
- Network connection logs — Sysmon Event ID 3 for any outbound connections initiated by the process, particularly to external IPs on ports 25 (SMTP), 443 (HTTPS), 21 (FTP), or non-standard ports. Correlate connection timestamps with clipboard access events.
- File creation logs — Sysmon Event ID 11 for any files written by the process, including staging files in %TEMP%, %APPDATA%, or ProgramData that may contain harvested clipboard contents before exfiltration.
- PowerShell ScriptBlock Logging — Event ID 4104 from Microsoft-Windows-PowerShell/Operational, which captures the deobfuscated script content including any Get-Clipboard invocations and what was done with the result.
- Process memory dump — If the malicious process is still running, capture a full memory dump using ProcDump or EDR capabilities. Memory analysis may reveal the clipboard history buffer, C2 configuration, and exfiltrated data.
- Prefetch files — C:\Windows\Prefetch\ for the malicious binary's prefetch file, providing execution timestamps, run count, and referenced DLLs (look for user32.dll usage which contains clipboard APIs).
- Scheduled task XML files — C:\Windows\System32\Tasks\ and C:\Windows\SysWOW64\Tasks\ for persistence entries created by the malware.
- Registry run keys — HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence entries pointing to the malicious binary.
- Browser clipboard access logs — Modern browsers log extension clipboard access in their debug logs; if a malicious browser extension is suspected, collect the browser profile directory and extension manifests.
Escalation Criteria
- !Clipboard monitoring loop detected (persistent polling with sleep intervals) — this is a definitive indicator of RAT-style clipboard harvesting and warrants immediate escalation to incident response.
- !Outbound network connection from clipboard-accessing process to external IP, especially over non-standard ports or shortly after clipboard API calls — indicates active exfiltration in progress.
- !User reports a cryptocurrency transaction was redirected to an unexpected wallet address — indicates a crypto-clipper is actively operating and financial loss may have already occurred.
- !Clipboard access from a process in a staging directory (%TEMP%, %APPDATA%, ProgramData) with no corresponding legitimate application — strong indicator of dropped malware payload.
- !Multiple users on different endpoints showing the same clipboard access pattern within a short timeframe — potential widespread infection or automated lateral movement.
- !Clipboard access immediately following execution of a macro-enabled Office document, script file, or downloaded executable — high confidence phishing-delivered initial access.
- !Process chain shows clipboard access from a child of a browser, email client, or document viewer without a corresponding legitimate browser extension or plugin — indicates exploitation or malicious code injection.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run — persistence entries pointing to clipboard-stealing malware often registered here for user-level persistence - >
Registry: HKLM\SYSTEM\CurrentControlSet\Services — service-based persistence for elevated clipboard stealers; examine ImagePath and Description fields - >
File System: %TEMP%\*.dat, %APPDATA%\*.log — common staging locations where clipboard-harvesting malware writes captured content before exfiltration - >
File System: C:\Windows\Prefetch\POWERSHELL.EXE-*.pf — execution timestamps and DLL references for PowerShell-based clipboard access - >
File System: C:\Windows\Prefetch\[MALWARE].EXE-*.pf — prefetch file for the malicious binary with execution count and timestamp history - >
Windows Clipboard History: Registry HKCU\SOFTWARE\Microsoft\Clipboard — Windows 10 1809+ clipboard history entries (if clipboard history feature enabled by user) - >
Event Log: Microsoft-Windows-PowerShell/Operational (Event ID 4104) — ScriptBlock logging captures Get-Clipboard invocations with full script context - >
Event Log: Microsoft-Windows-Sysmon/Operational (Event ID 3) — network connections from the clipboard-stealing process to C2 infrastructure - >
Memory: Process memory of the malicious binary — may contain in-memory clipboard buffer with captured data awaiting exfiltration, C2 configuration, and encryption keys - >
Network: Proxy/firewall logs — HTTP POST requests containing Base64-encoded or encrypted clipboard data sent to C2 server, often with distinctive User-Agent strings associated with specific RAT families
Tuning Guidance
Begin by establishing a baseline of legitimate clipboard-accessing applications in your environment. Common high-volume false positive sources include: (1) password managers running auto-clear scripts — these should be allowlisted by their specific binary path and parent process; (2) VDI/RDP clipboard agents running as system services — identify by their service name and allowlist the specific binary path; (3) productivity tools like clipboard managers (Ditto, CopyQ) — allowlist by their executable location under Program Files. For the persistent monitoring loop detection branch, tune the threshold based on your environment's automation footprint. In environments running extensive PowerShell automation, add exclusions for specific service accounts used by configuration management tools (SCCM, Ansible). The crypto-clipper use case (replacing clipboard contents with attacker wallet addresses) is better detected by monitoring for high-frequency clipboard write operations alongside reads — consider adding DeviceProcessEvents monitoring for Set-Clipboard and Win32 API calls to SetClipboardData in environments where cryptocurrency use is relevant. For organizations with heavy Python automation, allowlist specific virtual environment paths where pyperclip usage is expected (e.g., E:\automation_venvs\). The medium confidence rating reflects that API-level clipboard access by compiled malware (OpenClipboard/GetClipboardData directly) without a corresponding subprocess creation event will not be caught by process-level detection alone — consider deploying Sysmon with DLL load monitoring (Event ID 7) for user32.dll in high-risk scenarios.
Hunting Queries
Hunt for accounts or parent processes that invoke PowerShell Get-Clipboard at high frequency, which indicates a persistent monitoring loop typical of RAT implants. More than 5 accesses per hour or sustained access over 10 minutes without user-initiated copy actions strongly suggests automated clipboard harvesting.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has "Get-Clipboard"
| summarize ClipboardAccessCount=count(), Devices=dcount(DeviceName), Earliest=min(Timestamp), Latest=max(Timestamp), Commands=make_set(ProcessCommandLine, 5) by AccountName, InitiatingProcessFileName
| extend DurationMinutes=datetime_diff('minute', Latest, Earliest)
| where ClipboardAccessCount > 5 or DurationMinutes > 10
| sort by ClipboardAccessCount descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\powershell.exe" OR Image="*\\pwsh.exe") CommandLine="*Get-Clipboard*"
| bin _time span=1h
| stats count as ClipboardAccessCount, dc(host) as Devices, values(CommandLine) as Commands by User, ParentImage, _time
| where ClipboardAccessCount > 5
| sort - ClipboardAccessCountHunt for processes that both access the clipboard AND make outbound network connections to public IPs within the same process lifetime. This correlation is a high-fidelity indicator of active clipboard data exfiltration — the process reads clipboard content then immediately transmits it to a C2 server.
let ClipboardAccess = DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-Clipboard", "Clipboard.GetText", "GetClipboardData"))
or (FileName in~ ("python.exe", "python3.exe") and ProcessCommandLine has_any ("win32clipboard", "pyperclip", "clipboard.paste"))
| project ClipboardTime=Timestamp, DeviceName, AccountName, ProcessId, ClipboardProcess=FileName, ClipboardCmd=ProcessCommandLine;
let NetworkConns = DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| project NetTime=Timestamp, DeviceName, AccountName, InitiatingProcessId, RemoteIP, RemotePort, RemoteUrl;
ClipboardAccess
| join kind=inner NetworkConns on DeviceName, AccountName, $left.ProcessId == $right.InitiatingProcessId
| where NetTime between (ClipboardTime .. (ClipboardTime + 5min))
| project ClipboardTime, NetTime, DeviceName, AccountName, ClipboardProcess, ClipboardCmd, RemoteIP, RemotePort, RemoteUrl
| sort by ClipboardTime descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval EventCode=tonumber(EventCode)
| where EventCode=1 OR EventCode=3
| eval isClipboard=if(EventCode=1 AND (match(lower(CommandLine), "(get-clipboard|win32clipboard|pyperclip|getclipboarddata)") AND match(lower(Image), "(powershell|python|pwsh)")), 1, 0)
| eval isNetwork=if(EventCode=3 AND NOT match(DestinationIp, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|127\.)"), 1, 0)
| eval processKey=coalesce(ProcessId, ProcessGuid)
| stats sum(isClipboard) as ClipboardEvents, sum(isNetwork) as NetworkEvents, values(CommandLine) as Commands, values(DestinationIp) as ExternalIPs by host, User, processKey
| where ClipboardEvents > 0 AND NetworkEvents > 0
| sort - ClipboardEventsHunt for clipboard-accessing processes executing from suspicious user-writable directories (%TEMP%, %APPDATA%, ProgramData, Users\Public). Legitimate clipboard utilities reside in system directories; malware dropped by phishing or exploits typically runs from these staging locations. This query finds dropped malware that has been given clipboard harvesting capability.
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe", "python.exe", "python3.exe", "wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any ("Get-Clipboard", "win32clipboard", "pyperclip", "GetClipboardData", "OpenClipboard")
| where FolderPath has_any ("\\Temp\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\ProgramData\\", "\\Users\\Public\\")
or InitiatingProcessFolderPath has_any ("\\Temp\\", "\\AppData\\Local\\Temp\\", "\\AppData\\Roaming\\", "\\ProgramData\\", "\\Users\\Public\\")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine
| sort by Timestamp descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| eval CommandLine=lower(CommandLine), Image=lower(Image), CurrentDirectory=lower(CurrentDirectory)
| where (match(Image, "(powershell\.exe|pwsh\.exe|python[0-9]*\.exe|wscript\.exe|cscript\.exe)"))
AND (match(CommandLine, "(get-clipboard|win32clipboard|pyperclip|getclipboarddata|openclipboard)"))
AND (match(CurrentDirectory, "(\\temp\\|\\appdata\\|\\programdata\\|\\users\\public\\)") OR match(Image, "(\\temp\\|\\appdata\\|\\programdata\\|\\users\\public\\)"))
| table _time, host, User, Image, CommandLine, ParentImage, CurrentDirectory
| sort - _timeAtomic Red Team Tests
Reads and outputs current clipboard contents using PowerShell's Get-Clipboard cmdlet — the most common Windows-native method used by post-exploitation frameworks, RAT implants, and InfoStealer malware. This simulates a single clipboard capture event as performed by Agent Tesla, Empire, and SILENTTRINITY.
Command
powershell.exe -NoProfile -Command "$clipData = Get-Clipboard; Write-Output \"[Clipboard Captured]: $clipData\"; $clipData | Out-File $env:TEMP\df00tech-clip-test.txt"Cleanup
Remove-Item $env:TEMP\df00tech-clip-test.txt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-Clipboard'. Sysmon Event ID 11: File Create for %TEMP%\df00tech-clip-test.txt. PowerShell ScriptBlock Log Event ID 4104 showing the full Get-Clipboard invocation. Security Event ID 4688 if command line auditing is enabled.
Expected Detection
KQL: ClipboardViaScript branch fires, ClipboardMethod='PowerShell Get-Clipboard'. SPL: ClipboardAPI=1, SuspicionScore>=1, DetectionBranch='ScriptClipboardAccess'.
Implements a clipboard polling loop that captures clipboard content every 2 seconds for 30 seconds — matching the behavior of RAT implants such as Agent Tesla and DarkComet that continuously monitor the clipboard for high-value data. The loop writes captures to a staging file before simulated exfiltration.
Command
powershell.exe -NoProfile -WindowStyle Hidden -Command "$endTime = (Get-Date).AddSeconds(30); $lastClip = ''; while ((Get-Date) -lt $endTime) { $clip = Get-Clipboard; if ($clip -ne $lastClip -and $clip -ne $null) { $lastClip = $clip; Add-Content $env:TEMP\df00tech-clip-harvest.txt \"[$(Get-Date -Format 'HH:mm:ss')] $clip\" }; Start-Sleep -Seconds 2 }"Cleanup
Remove-Item $env:TEMP\df00tech-clip-harvest.txt -ErrorAction SilentlyContinueExpected Telemetry
Sysmon Event ID 1: Process Create with CommandLine containing 'Get-Clipboard', 'while', 'Start-Sleep', and '-WindowStyle Hidden'. PowerShell ScriptBlock Log Event ID 4104 showing the full loop. Sysmon Event ID 11: File Create and multiple File Modify events for the staging file. Multiple writes to the staging file visible in DeviceFileEvents.
Expected Detection
KQL: ClipboardMonitoringLoop branch fires due to 'Get-Clipboard' + 'while' + 'Start-Sleep' pattern. SPL: ClipboardLoop=1, SuspicionScore>=3, DetectionBranch='ClipboardMonitoringLoop'. The -WindowStyle Hidden flag may additionally trigger PowerShell detection rules.
Uses Python's win32clipboard module (part of pywin32) to directly call the Win32 OpenClipboard and GetClipboardData APIs — matching the method used by Astaroth malware. This simulates malware that uses Python or embeds Python runtime for credential harvesting operations.
Command
python.exe -c "import win32clipboard; win32clipboard.OpenClipboard(); data = win32clipboard.GetClipboardData(); win32clipboard.CloseClipboard(); print('[Clipboard]:', data)"Expected Telemetry
Sysmon Event ID 1: Process Create with Image=python.exe, CommandLine containing 'win32clipboard', 'OpenClipboard', and 'GetClipboardData'. Security Event ID 4688 if command line auditing is enabled. Note: requires pywin32 package installed (pip install pywin32).
Expected Detection
KQL: ScriptClipboardAccess branch fires, ClipboardMethod='Python Clipboard Module'. SPL: ClipboardAPI=1, SuspicionScore>=1. If Python executable is in an unusual path (AppData, Temp), the staging directory hunting query also fires.
Reads X11 clipboard contents using xclip and redirects output to a file — simulating the collection phase of clipboard theft on Linux systems as referenced in the ATT&CK procedure examples (Empire's EmPyre framework using pbpaste-equivalent on Linux). Requires an X11 display environment.
Command
xclip -selection clipboard -o > /tmp/df00tech-clipboard-capture.txt && echo "[Captured]" && cat /tmp/df00tech-clipboard-capture.txtCleanup
rm -f /tmp/df00tech-clipboard-capture.txtExpected Telemetry
Auditd syscall log with EXECVE for xclip with arguments '-selection clipboard -o'. Syslog process creation event for xclip. File creation event for /tmp/df00tech-clipboard-capture.txt. If Sysmon for Linux is deployed: EventCode=1 with Image=/usr/bin/xclip.
Expected Detection
Linux-specific detection triggers on xclip/xsel process creation with output redirection. KQL: NativeClipUtil branch for xclip. SPL: NativeClipUtil=1. If parent is a script interpreter or unusual process, SuspiciousParent=1 raises score.
Reads clipboard contents using macOS's native pbpaste utility and writes to a staging file — the macOS equivalent of clipboard theft as documented in the MacSpy malware and Empire framework operation with EmPyre. This simulates the data collection phase before exfiltration.
Command
pbpaste > /tmp/df00tech-clipboard-macos.txt && echo "Clipboard captured to /tmp/df00tech-clipboard-macos.txt" && cat /tmp/df00tech-clipboard-macos.txtCleanup
rm -f /tmp/df00tech-clipboard-macos.txtExpected Telemetry
macOS Unified Log (ULS): process creation for pbpaste with arguments. File creation for /tmp/df00tech-clipboard-macos.txt. If Jamf or similar MDM telemetry is deployed, process execution event with parent shell context. ESF (Endpoint Security Framework) events if EDR is deployed.
Expected Detection
macOS-specific rule triggers on pbpaste process creation, particularly when spawned from non-interactive shells, scripts, or suspicious parent processes. The file creation in /tmp further correlates with staging behavior.