Windows process creation: Obfuscated Clip.exe used to execute PowerShell

Alerts when cmd.exe uses obfuscated Clip.exe/clipboard calls to launch PowerShell.

FreeUnreviewedSigmahighv1

windows-process-creation-obfuscated-clip-exe-used-to-execute-powershell-b222df08

title: "Windows process creation: Obfuscated Clip.exe used to execute PowerShell"
id: abf72172-1c8a-4635-ac06-9153c02bf756
status: test
description: This rule flags Windows command lines that combine an obfuscated use of Clip.exe with PowerShell execution. Attackers use Clipboard/Clip-related patterns to stage or hide PowerShell payload logic, making this behavior a stealthy execution technique. Detection relies on process creation telemetry and matches specific command-line substrings and separators indicating cmd.exe invocation, clipboard access, and PowerShell parameters including -f.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2022-11-17
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - cmd
      - "&&"
      - "clipboard]::"
      - -f
    CommandLine|contains:
      - /c
      - /r
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b222df08-0e07-11eb-adc1-0242ac120002
    type: derived

What it detects

This rule flags Windows command lines that combine an obfuscated use of Clip.exe with PowerShell execution. Attackers use Clipboard/Clip-related patterns to stage or hide PowerShell payload logic, making this behavior a stealthy execution technique. Detection relies on process creation telemetry and matches specific command-line substrings and separators indicating cmd.exe invocation, clipboard access, and PowerShell parameters including -f.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.