huntrule

PowerShell Get-Clipboard Cmdlet Execution via CLI on Windows

Flags Windows command lines containing Get-Clipboard, indicating potential clipboard data collection via PowerShell.

FreeReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2020-05-02
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Collection

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process executions where the command line contains the PowerShell Get-Clipboard cmdlet. Adversaries can use clipboard access to collect sensitive information from the system without direct user interaction. The detection relies on Windows process creation telemetry, specifically the command line content of spawned processes.

Reporting behind it

Related detections9 linkedT1115 — drag to rearrange
Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)
Possible Clipboard Data Capture via PowerShell (via process_creation)
macOS pbpaste Clipboard Read via Process Execution
macOS osascript Clipboard Access via AppleScript Commands
Linux Clipboard Data Collection via xclip -sel clip -o
Linux xclip Clipboard Image Collection via Image MIME Types
Clipboard Data Collection via xclip (auditd Linux EXECVE)
Windows: clip.exe Execution to Copy Data to Clipboard
Windows PowerShell Get-Clipboard Command Execution
PowerShell Get-Clipboard Cmdlet Execution via CLI on Windows
Pivot detection · T1115 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.