Data Copied To Clipboard Via Clip.EXE

Title: Data Copied To Clipboard Via Clip.EXE
Status: test
Description:Detects the execution of clip.exe in order to copy data to the clipboard. Adversaries may collect data stored in the clipboard from users copying information within or between applications.
References:
  -https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md
Author: frack113
Date: 2021-07-27
modified:2023-02-21
Tags:

• -'attack.collection'
• -'attack.t1115'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\clip.exe' OriginalFileName:'clip.exe'   condition:selection
Falsepositives:
  -Unknown
Level: low