PowerShell obfuscation via clip.exe and clipboard data execution

title: PowerShell obfuscation via clip.exe and clipboard data execution
id: fea54bf8-b774-4fc6-86ef-c2ba615273bd
status: test
description: This rule matches PowerShell script block text that uses command chaining with clip/clipboard activity and includes an apparent clipboard-driven payload (e.g., Clipboard/invoke-like patterns). Attackers can use this technique to move or reconstruct content via the clipboard and then execute it, making the payload harder to recognize in transit. It relies on PowerShell Script Block Logging telemetry that records the full script block text, looking for the specific clip-related and clipboard/invocation patterns.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2024-04-15
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_4104:
    ScriptBlockText|re: (?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?)
  condition: selection_4104
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: db92dd33-a3ad-49cf-8c2c-608c3e30ace0
    type: derived