Windows PowerShell Obfuscation Using Clip.exe via Clipboard Invoke

Flags Windows command lines indicating clip.exe clipboard use followed by obfuscated PowerShell invoke behavior.

FreeUnreviewedSigmahighv1

windows-powershell-obfuscation-using-clip-exe-via-clipboard-invoke-e1561947

title: Windows PowerShell Obfuscation Using Clip.exe via Clipboard Invoke
id: 18a521e5-6418-451e-aa7d-4d10d82e2768
status: test
description: This rule matches Windows process creation events where the command line uses a clipboard path involving clip.exe and an obfuscated PowerShell invoke pattern. Attackers can use this technique to stage or execute code through the clipboard while making the command content harder to read and analyze. The detection relies on process creation telemetry (command line) and looks for case-insensitive strings indicating clip.exe usage combined with clipboard-related invoke behavior.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2026-03-16
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re: (?i)echo.*clip.*&&.*(?:Clipboard|i`?n`?v`?o`?k`?e`?)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e1561947-b4e3-4a74-9bdd-83baed21bdb5
    type: derived

What it detects

This rule matches Windows process creation events where the command line uses a clipboard path involving clip.exe and an obfuscated PowerShell invoke pattern. Attackers can use this technique to stage or execute code through the clipboard while making the command content harder to read and analyze. The detection relies on process creation telemetry (command line) and looks for case-insensitive strings indicating clip.exe usage combined with clipboard-related invoke behavior.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.