Home/ATT&CK Technique/Clipboard Data
ATT&CK Technique

Clipboard Data

T1115 · collection

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation). macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.

LinuxmacOSWindows
◆

Actors Using This

14
latin_america_brazilian_organized_cybercrimeAmavaldo
north_koreaAndariel
franceAnimal Farm
chinaAoqin Dragon
chinaAPT10
chinaAPT17
chinaAPT1
chinaAPT31
iranAPT33
iranOilRig
iranAPT35
north_koreaAPT37
north_koreaAPT38
iranAPT39
◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.
reconnaissance earlier
T1589.002 · Email Addresses ×2.35
initial-access earlier
T1456 · Drive-By Compromise ×2.70
persistence earlier
T1137.001 · Office Template Macros ×2.70T1137.006 · Add-ins ×2.70
privilege-escalation earlier
T1546.001 · Change Default File Association ×2.70T1546.011 · Application Shimming ×2.43
credential-access earlier
T1555.004 · Windows Credential Manager ×2.37
discovery earlier
T1426 · System Information Discovery ×2.70
collection same
T1056.002 · GUI Input Capture ×2.70T1417 · Input Capture ×2.70
command-and-control later
T1437 · Application Layer Protocol ×2.70T1437.001 · Web Protocols ×2.70
other same
T1027.011 · Fileless Storage ×2.70T1218.007 · Msiexec ×2.50T1564.003 · Hidden Window ×2.40
▸

Atomic Tests

5
Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.
command_promptwindowsUtilize Clipboard to store or execute commands from
Add data to clipboard to copy off or execute commands from. 
dir | clip
echo "T1115" > %temp%\T1115.txt
clip < %temp%\T1115.txt
powershellwindowsExecute Commands from Clipboard using PowerShell
Utilize PowerShell to echo a command to clipboard and execute it 
echo Get-Process | clip
Get-Clipboard | iex
bashmacosExecute commands from clipboard
Echo a command to clipboard and execute it
echo ifconfig | pbcopy
$(pbpaste)
powershellwindowsCollect Clipboard Data via VBA
This module copies the data stored in the user's clipboard and writes it to a file, $env:TEMP\atomic_T1115_clipboard_data.txt 
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Set-Clipboard -value "Atomic T1115 Test, grab data from clipboard via VBA"
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1115\src\T1115-macrocode.txt" -officeProduct "Word" -sub "GetClipboard"
shlinuxAdd or copy content to clipboard with xClip
Utilize Linux Xclip to copy history and place in clipboard then output to a history.txt file. Successful execution will capture history and output to a file on disk. 
apt install xclip -y
history | tail -n 30 | xclip -sel clip
xclip -o > history.txt
◈

Detection Coverage

1/6 layers
Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).
Behavioral / log (Sigma) 7
Analytics (MITRE CAR) none
Runtime / container (Falco) none
File / malware (YARA) none
Network (Suricata/Snort) none
Vuln scan (Nuclei) none
▸

Caldera Emulation

1
MITRE Caldera abilities that emulate this technique - each is an executable action for automated adversary emulation.
collectiondarwin, windows, linuxCopy Clipboard
pbpaste
Intelligence Graph · click any node to traverse
CVETechnique ActorTool Family
drag to reposition · click any node to traverse · button top-right enlarges
External lookups - second-class, for what we don’t hold ourselves
MITRE ATT&CKAtomic Red Teamcar (MITRE)
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin