T1115 Clipboard Data

Technique

T1115

Tactics

Collection

Research, 90 days

3

KEV CVEs mapped

0

SigmaHQ rules

8

Elastic, Splunk

8

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1115

MITRE description

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.(Citation: Operating with EmPyre)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-22 Group-IB: Inside SiriusQT: A Seriously Skilled RAT
• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
• 2026-10-08 Zscaler ThreatLabz: Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform Malware

Detection coverage

SigmaHQ community rules

• Clipboard Data Collection Via Pbpaste (threat-hunting)
• Clipboard Collection with Xclip Tool - Auditd (core)
• Clipboard Collection of Image Data with Xclip Tool (core)
• Clipboard Collection with Xclip Tool (core)
• Clipboard Access Via OSAScript (core)
• PowerShell Get Clipboard (core)
• Data Copied To Clipboard Via Clip.EXE (core)
• PowerShell Get-Clipboard Cmdlet Via CLI (core)

Elastic and Splunk rules

• Linux Clipboard Activity Detected (elastic)
• Pbpaste Execution via Unusual Parent Process (elastic)
• Suspicious pbpaste High Volume Activity (elastic)
• PowerShell Suspicious Script with Clipboard Retrieval Capabilities (elastic)
• Linux Auditd Clipboard Data Copy (splunk)
• Linux Clipboard Data Copy (splunk)
• Windows ClipBoard Data via Get-ClipBoard (splunk)
• Windows Post Exploitation Risk Behavior (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.