T1115 — Clipboard Data

Tactic: Collection · Platforms: Linux, macOS, Windows

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data…

Sigma detection rules (3)

T1115 Clipboard Data

title: T1115 Clipboard Data
id: f4a9e55b-1db3-4493-b6d7-71e1702b84fc
description: 'Detects clip.exe or PowerShell/.NET clipboard APIs reading clipboard contents. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, UserContext, ParentProcessName.'
references:
  - https://attack.mitre.org/techniques/T1115
author: Shahrukh Khan
date: 2026-06-03
license: MIT
tags:
  - attack.collection
  - attack.t1115

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_clip_exe:
    EventID: '1'
    Image|endswith: '\clip.exe'
  selection_get_clipboard:
    EventID: '1'
    CommandLine|contains:
      - 'Get-Clipboard'
      - '[System.Windows.Forms.Clipboard]'
      - 'Windows.ApplicationModel.DataTransfer.Clipboard'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: (selection_clip_exe or selection_get_clipboard) and not filter_system_account

falsepositives:
  - Admin/scripts legitimately using clip.exe/Get-Clipboard.

level: medium

T1115 Clipboard Data

title: T1115 Clipboard Data
id: 3fd60724-905f-46ff-acb7-c3bf3f8b875f
description: 'Clipboard Data Access with Anomalous Context. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ClipboardCommand, CorrelationWindow, TTYLinked.'
references:
  - https://attack.mitre.org/techniques/T1115
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.collection
  - attack.t1115

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/xclip'
      - '/xsel'

  condition: selection

falsepositives:
  - xclip/xsel are common clipboard-manager and scripting utilities on Linux desktops; expect frequent benign use on workstations, correlate with repeated access from unattended sessions.

level: medium

T1115 Clipboard Data

title: T1115 Clipboard Data
id: d255906c-9e4e-449f-8e05-4fe6a0f4dbc6
description: 'Clipboard Data Access with Anomalous Context. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ExecutionChainLength, TerminalSession, BinaryPath.'
references:
  - https://attack.mitre.org/techniques/T1115
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.collection
  - attack.t1115

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith:
      - '/pbpaste'
      - '/pbcopy'
    ParentImage|endswith:
      - '/python3'
      - '/osascript'
      - '/bash'

  condition: selection

falsepositives:
  - Legitimate clipboard-manager utilities and automation scripts use pbpaste and pbcopy extensively.

level: medium

Explore