Windows: clip.exe Executed to Copy Data to Clipboard

Flags execution of clip.exe on Windows, a common utility for copying data into the clipboard.

FreeUnreviewedSigmalowv1

windows-clip-exe-executed-to-copy-data-to-clipboard-ddeff553

title: "Windows: clip.exe Executed to Copy Data to Clipboard"
id: cb459167-d64d-4e05-9509-0e357eb36b00
status: test
description: This rule identifies process creation events where clip.exe is executed, which is commonly used to copy content into the Windows clipboard. Attackers may use clipboard access to stage or exfiltrate sensitive data that users copy between applications. The detection relies on Windows process creation telemetry using the executed image path ending in clip.exe and the OriginalFileName matching clip.exe.
references:
  - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_clip_execution.yml
author: frack113, Huntrule Team
date: 2021-07-27
modified: 2023-02-21
tags:
  - attack.collection
  - attack.t1115
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \clip.exe
    - OriginalFileName: clip.exe
  condition: selection
falsepositives:
  - Unknown
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_clip_execution/info.yml
simulation:
  - type: atomic-red-team
    name: Utilize Clipboard to store or execute commands from
    technique: T1115
    atomic_guid: 0cd14633-58d4-4422-9ede-daa2c9474ae7
license: DRL-1.1
related:
  - id: ddeff553-5233-4ae9-bbab-d64d2bd634be
    type: derived

What it detects

This rule identifies process creation events where clip.exe is executed, which is commonly used to copy content into the Windows clipboard. Attackers may use clipboard access to stage or exfiltrate sensitive data that users copy between applications. The detection relies on Windows process creation telemetry using the executed image path ending in clip.exe and the OriginalFileName matching clip.exe.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.