Windows Service Control Manager: Clipboard-Related Clip.exe Execution via System Startup

title: "Windows Service Control Manager: Clipboard-Related Clip.exe Execution via System Startup"
id: 66c0c82a-bdfe-4c51-809d-05b1a3fc738d
status: test
description: This rule flags Windows System (Service Control Manager) events where the service ImagePath contains clipboard-related clip executable text patterns. Attackers can use clipboard-related binaries to stage or disguise PowerShell or other execution flows, making these service-start launches important for stealth and persistence detection. The detection relies on System EventID 7045 telemetry and the service ImagePath content matching clipboard/clip-related strings.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ImagePath|contains: (Clipboard|i
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 63e3365d-4824-42d8-8b82-e56810fefa0c
    type: derived