Windows Security EID 4697: PowerShell launching via Clip.exe pattern

title: "Windows Security EID 4697: PowerShell launching via Clip.exe pattern"
id: c975091c-0422-45cf-8987-5b32b9d836a9
related:
  - id: 63e3365d-4824-42d8-8b82-e56810fefa0c
    type: derived
  - id: 1a0a2ff1-611b-4dac-8216-8a7b47c618a6
    type: derived
status: test
description: This rule flags obfuscated PowerShell-related activity when the Windows Service Control Manager logs a service installation event (EID 4697) whose service file name matches a Clipboard/Clip.exe substring pattern. Attackers can use Clip.exe and script-based execution to stage payloads and hinder analysis through PowerShell obfuscation. The detection relies on Security log telemetry for EID 4697 and the service file name field containing the specified Clip/clipboard indicators.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains: (Clipboard|i
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1