Adversaries may collect data stored in the clipboard from users copying information within or between applications.
For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.[1][2][3] Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation).[4]
macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.[5]
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
During Operation Wocao, threat actors collected clipboard data in plaintext.1
2017–2019
All 1 campaigns for this technique
41 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has stolen data from the clipboard using the Python project “pyperclip”.123InvisibleFerret has also captured clipboard contents during copy and paste operations.4
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Clipboard Data Access with Anomalous Context
Enterprise
3 platforms
AN0965 · Windows
Detection of clipboard access via OS utilities (e.g., clip.exe, Get-Clipboard) by non-interactive or abnormal parent processes, potentially chained with staging or exfiltration commands.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
ExecutionChainLength
How many chained or embedded processes to track for correlation.
TerminalSession
Whether the pbpaste/pbcopy action is tied to a user terminal.
BinaryPath
Adjust if clipboard tooling is relocated (e.g., /opt/empyre/pbpaste).
AN0967 · Linux
Detection of xclip or xsel access to clipboard buffers outside of user terminal context, especially when chained to staging (gzip, base64) or network exfiltration (curl, scp).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"
GUID9c8d5a72-9c98-48d3-b9bf-da2cc43bdf52
05
Add or copy content to clipboard with xClip
linux
sh
—
—
—
Utilize Linux Xclip to copy history and place in clipboard then output to a history.txt file. Successful execution will capture history and output to a file on disk.