PowerShell module obfuscation using clip.exe with echo and clipboard invocation

Flags obfuscated PowerShell module scripts that echo “clip” and invoke clipboard-related behavior.

FreeReviewedSigma · High · v2

Product: windows
Category: ps_module
Author: Nikita Nazarov, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-09
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell module/script content that matches an obfuscation pattern involving echo statements that reference clip and a subsequent Clipboard or clipboard-related invocation (including variations with backticks). Attackers may use clip.exe to move data to or from the clipboard while disguising intent through string/command obfuscation. It relies on PowerShell module/script telemetry that includes the full Payload text for regex matching.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

Suspicious Hidden PowerShell Executing Substring of Dropped File

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

Obfuscated Encoded PowerShell Payload Deployed - PowerShell (via powershell)

Suspicious PowerShell AES Decryption and Reflective Method Invocation in SolarMarker

PowerShell module obfuscation using clip.exe with echo and clipboard invocation

Pivot detection · T1027 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-module-abuse-with-clip-exe-via-obfuscated-use-of-clipboard-payload-ebdf49d8

title: PowerShell module obfuscation using clip.exe with echo and clipboard invocation
id: 4ff02be7-1e10-4c45-ad1b-4e1427b993c2
related:
  - id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0
    type: derived
  - id: ebdf49d8-b89c-46c9-8fdf-2c308406f6bd
    type: derived
status: test
description: This rule flags PowerShell module/script content that matches an obfuscation pattern involving echo statements that reference clip and a subsequent Clipboard or clipboard-related invocation (including variations with backticks). Attackers may use clip.exe to move data to or from the clipboard while disguising intent through string/command obfuscation. It relies on PowerShell module/script telemetry that includes the full Payload text for regex matching.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2024-04-05
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?)
  condition: selection_4103
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL