Windows PowerShell Get-Clipboard Command Execution

Flags PowerShell activity that includes the Get-Clipboard command, which may be used to collect clipboard contents.

FreeReviewedSigma · Medium · v2
Product
windows
Category
ps_module
Author
Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) (SigmaHQ), DRL 1.1
Published
2020-05-02
Updated
2026-07-31
title: Windows PowerShell Get-Clipboard Command Execution
id: 947c5daf-453a-4a4a-93a8-f7143fcf5945
status: test
description: This rule matches PowerShell module logging events whose script content contains the Get-Clipboard command. Access to clipboard contents can enable attackers to capture sensitive data copied by a user. The detection relies on PowerShell telemetry that records module/script payload text and identifies the presence of Get-Clipboard.
references:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/16
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_get_clipboard.yml
author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Huntrule Team
date: 2020-05-02
modified: 2023-01-04
tags:
  - attack.collection
  - attack.t1115
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection:
    Payload|contains: Get-Clipboard
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4cbd4f12-2e22-43e3-882f-bff3247ffb78
    type: derived