CmdID

CmdID / Commands

pbpaste

Send the contents of the clipboard to stdout. tldr-pages

On macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Send the contents of the clipboard to stdout. Comparable to pressing <Cmd v> on the keyboard.

Write the contents of the clipboard to a file

pbpaste >path/to/fileIdentify

Trips 1 Sigma rule: mediumClipboard Data Collection Via Pbpaste by Daniel Cortez

Use the contents of the clipboard as input to a command

pbpaste | grep search_stringIdentify

Trips 1 Sigma rule: mediumClipboard Data Collection Via Pbpaste by Daniel Cortez

What detects it

Sigma process creation rules that name pbpaste
mediumClipboard Data Collection Via PbpasteDaniel Cortez