huntrule

Windows PowerShell Get-Clipboard Module Command Execution

Flags PowerShell activity that includes the Get-Clipboard command, which may be used to collect clipboard contents.

FreeUnreviewedSigmamediumv1
title: Windows PowerShell Get-Clipboard Module Command Execution
id: 947c5daf-453a-4a4a-93a8-f7143fcf5945
status: test
description: This rule matches PowerShell module/script activity containing the string 'Get-Clipboard'. The behavior can indicate an attempt to collect sensitive data from the system clipboard. It relies on Windows PowerShell logging that records executed payload content and scans for the Get-Clipboard command text.
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/16
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_get_clipboard.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2023-01-04
tags:
  - attack.collection
  - attack.t1115
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    Payload|contains: Get-Clipboard
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4cbd4f12-2e22-43e3-882f-bff3247ffb78
    type: derived

What it detects

This rule matches PowerShell module/script activity containing the string 'Get-Clipboard'. The behavior can indicate an attempt to collect sensitive data from the system clipboard. It relies on Windows PowerShell logging that records executed payload content and scans for the Get-Clipboard command text.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.