Windows: clip.exe Execution to Copy Data to Clipboard
Flags execution of clip.exe on Windows, a common utility for copying data into the clipboard.
FreeReviewedSigma · Low · v2
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-07-27
- Updated
- 2026-07-31
ATT&CK techniques
CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where clip.exe is launched, consistent with copying data into the Windows clipboard. Attackers can use the clipboard as an intermediate store to move or stage sensitive content between applications. Detection relies on Windows process creation telemetry capturing the executed image path and/or original file name as clip.exe.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_clip_execution.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-clip-exe-executed-to-copy-data-to-clipboard-ddeff553
title: "Windows: clip.exe Execution to Copy Data to Clipboard"
id: cb459167-d64d-4e05-9509-0e357eb36b00
status: test
description: This rule identifies process executions where clip.exe is launched, consistent with copying data into the Windows clipboard. Attackers can use the clipboard as an intermediate store to move or stage sensitive content between applications. Detection relies on Windows process creation telemetry capturing the executed image path and/or original file name as clip.exe.
references:
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_clip_execution.yml
author: frack113, Huntrule Team
date: 2021-07-27
modified: 2023-02-21
tags:
- attack.collection
- attack.t1115
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \clip.exe
- OriginalFileName: clip.exe
condition: selection
falsepositives:
- Unknown
level: low
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_clip_execution/info.yml
simulation:
- type: atomic-red-team
name: Utilize Clipboard to store or execute commands from
technique: T1115
atomic_guid: 0cd14633-58d4-4422-9ede-daa2c9474ae7
license: DRL-1.1
related:
- id: ddeff553-5233-4ae9-bbab-d64d2bd634be
type: derived