Windows Security 4697 CLIP.exe Obfuscated PowerShell via cmd and Clipboard string

Alerts on service creation (Windows 4697) with CLIP.exe command-line patterns that indicate obfuscated PowerShell execution.

FreeUnreviewedSigmahighv1

windows-security-4697-clip-exe-obfuscated-powershell-via-cmd-and-clipboard-strin-4edf51e1

title: Windows Security 4697 CLIP.exe Obfuscated PowerShell via cmd and Clipboard string
id: 7360fc77-bad8-4f2f-a490-6578ecfe9e06
related:
  - id: f7385ee2-0e0c-11eb-adc1-0242ac120002
    type: derived
  - id: 4edf51e1-cb83-4e1a-bc39-800e396068e3
    type: derived
status: test
description: This rule flags Windows Security event 4697 where a service is created using a ServiceFileName containing command-line indicators consistent with obfuscated CLIP.exe execution of PowerShell (including 'cmd', '&&', and 'clipboard]::'). Attackers may use this pattern to hide PowerShell payloads and evade basic command-line visibility while still triggering a service creation event. It relies on Windows Security audit telemetry for event ID 4697 and string matching within the recorded ServiceFileName.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-13
modified: 2022-11-27
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains|all:
      - cmd
      - "&&"
      - "clipboard]::"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows Security event 4697 where a service is created using a ServiceFileName containing command-line indicators consistent with obfuscated CLIP.exe execution of PowerShell (including 'cmd', '&&', and 'clipboard]::'). Attackers may use this pattern to hide PowerShell payloads and evade basic command-line visibility while still triggering a service creation event. It relies on Windows Security audit telemetry for event ID 4697 and string matching within the recorded ServiceFileName.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.