PowerShell Get-Clipboard Cmdlet Via CLI
A Sigma rule for process creation on Windows, by Nasreddine Bencherchali (Nextron Systems).
medium 1 ATT&CK technique 6 everyday examples trip it
What it looks for
detection:
selection:
CommandLine|contains: 'Get-Clipboard'
condition: selection
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Nasreddine Bencherchali (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Get clipboard text on the page for get-clipboard
Get-ClipboardIdentifyGet clipboard content as specific text format on the page for get-clipboard
Get-Clipboard -TextFormatType TextIdentifyGet raw clipboard content on the page for get-clipboard
Get-Clipboard -RawIdentifyRetrieve an Image on the page for get-clipboard
Get-Clipboard -Format ImageIdentifyGet file paths copied in explorer on the page for get-clipboard
Get-Clipboard -Format FileDropListIdentifyGet the content of the clipboard on the page for Get-Clipboard
Set-Clipboard -Value 'hello world'
Get-ClipboardIdentify