CmdID

CmdID / Techniques

T1115 Clipboard Data

Adversaries may collect data stored in the clipboard from users copying information within or between applications. MITRE ATT&CK

5 Sigma rules T1115 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first
mediumClipboard Access Via OSAScriptSohan G (D4rkCiph3r) · macOS
mediumClipboard Data Collection Via PbpasteDaniel Cortez · macOS
mediumPowerShell Get-Clipboard Cmdlet Via CLINasreddine Bencherchali (Nextron Systems) · Windows
lowClipboard Collection with Xclip ToolPawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC · Linux
lowData Copied To Clipboard Via Clip.EXEfrack113 · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To copy the current directory listing to the Windows clipboard, type on the page for clip

dir | clipIdentify

To copy the output of a program called generic.awk to the Windows clipboard, type on the page for clip

awk -f generic.awk input.txt | clipIdentify

To copy the contents of a file called readme.txt to the Windows clipboard, type on the page for clip

clip < readme.txtIdentify

Copy the contents of a file to the Windows clipboard on the page for clip

clip <path\to\file.extIdentify

Copy text with a trailing newline to the Windows clipboard on the page for clip

echo some text | clipIdentify

Copy text without a trailing newline to the Windows clipboard on the page for clip

echo | set /p="some text" | clipIdentify

Get clipboard text on the page for get-clipboard

Get-ClipboardIdentify

Get clipboard content as specific text format on the page for get-clipboard

Get-Clipboard -TextFormatType TextIdentify

Get raw clipboard content on the page for get-clipboard

Get-Clipboard -RawIdentify

Retrieve an Image on the page for get-clipboard

Get-Clipboard -Format ImageIdentify

Get file paths copied in explorer on the page for get-clipboard

Get-Clipboard -Format FileDropListIdentify

Write the contents of the clipboard to a file on the page for pbpaste

pbpaste >path/to/fileIdentify

And 2 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1115: a Sigma rule it trips is tagged with it, or its abuse is documented as it.