huntrule

PowerShell module abuse with clip.exe via obfuscated use of Clipboard payload

Flags obfuscated PowerShell module scripts that echo “clip” and invoke clipboard-related behavior.

FreeUnreviewedSigmahighv1
title: PowerShell module abuse with clip.exe via obfuscated use of Clipboard payload
id: 4ff02be7-1e10-4c45-ad1b-4e1427b993c2
related:
  - id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0
    type: derived
  - id: ebdf49d8-b89c-46c9-8fdf-2c308406f6bd
    type: derived
status: test
description: This rule flags PowerShell module activity where the script content contains an obfuscated pattern that echoes content including “clip” and performs a clipboard-related action via invocation (including variants of clipboard and invoke). Attackers may use clip.exe and clipboard handling to stage or transport data while hiding intent through obfuscated PowerShell. It relies on Windows PowerShell module telemetry that captures the script payload text and matches it against the specific echo/clip and clipboard/invoke pattern.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2024-04-05
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?)
  condition: selection_4103
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell module activity where the script content contains an obfuscated pattern that echoes content including “clip” and performs a clipboard-related action via invocation (including variants of clipboard and invoke). Attackers may use clip.exe and clipboard handling to stage or transport data while hiding intent through obfuscated PowerShell. It relies on Windows PowerShell module telemetry that captures the script payload text and matches it against the specific echo/clip and clipboard/invoke pattern.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.