CmdID

CmdID / Commands

clip

Redirects the command output from the command line to the Windows clipboard. Windows commands reference

On Windows 1 Sigma rule name it File clip.exe

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

Redirects the command output from the command line to the Windows clipboard. You can use this command to copy data directly into any application that can receive text from the Clipboard. You can also paste this text output into other programs.

<command> | clip
clip < <filename>

To copy the current directory listing to the Windows clipboard, type

dir | clipIdentify

Trips 1 Sigma rule: lowData Copied To Clipboard Via Clip.EXE by frack113

To copy the output of a program called generic.awk to the Windows clipboard, type

awk -f generic.awk input.txt | clipIdentify

Trips 1 Sigma rule: lowData Copied To Clipboard Via Clip.EXE by frack113

To copy the contents of a file called readme.txt to the Windows clipboard, type

clip < readme.txtIdentify

Trips 1 Sigma rule: lowData Copied To Clipboard Via Clip.EXE by frack113

<command>Specifies a command whose output you want to send to the Windows clipboard.
<filename>Specifies a file whose contents you want to send to the Windows clipboard.
/?Displays help at the command prompt.

Windows

from tldr-pages, CC BY 4.0

Copy input content to the Windows clipboard.

Pipe command-line output to the Windows clipboard

dir | clipIdentify

Trips 1 Sigma rule: lowData Copied To Clipboard Via Clip.EXE by frack113

Copy the contents of a file to the Windows clipboard

clip <path\to\file.extIdentify

Trips 1 Sigma rule: lowData Copied To Clipboard Via Clip.EXE by frack113

Copy text with a trailing newline to the Windows clipboard

echo some text | clipIdentify

Trips 1 Sigma rule: lowData Copied To Clipboard Via Clip.EXE by frack113

Copy text without a trailing newline to the Windows clipboard

echo | set /p="some text" | clipIdentify

Trips 1 Sigma rule: lowData Copied To Clipboard Via Clip.EXE by frack113

What detects it

Sigma process creation rules that name clip
lowData Copied To Clipboard Via Clip.EXEfrack113