Data Copied To Clipboard Via Clip.EXE

A Sigma rule for process creation on Windows, by frack113.

low 1 ATT&CK technique 2 programs it names 6 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection:
    - Image|endswith: '\clip.exe'
    - OriginalFileName: 'clip.exe'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by frack113, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

To copy the current directory listing to the Windows clipboard, type on the page for clip

dir | clipIdentify

To copy the output of a program called generic.awk to the Windows clipboard, type on the page for clip

awk -f generic.awk input.txt | clipIdentify

To copy the contents of a file called readme.txt to the Windows clipboard, type on the page for clip

clip < readme.txtIdentify

Copy the contents of a file to the Windows clipboard on the page for clip

clip <path\to\file.extIdentify

Copy text with a trailing newline to the Windows clipboard on the page for clip

echo some text | clipIdentify

Copy text without a trailing newline to the Windows clipboard on the page for clip

echo | set /p="some text" | clipIdentify

Programs and files it names

their pages here

clipclip.exe

ATT&CK

the techniques it is tagged with

T1115Clipboard Data

Data Copied To Clipboard Via Clip.EXE

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1115 Clipboard Data