{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1115","id":"T1115","name":"Clipboard Data","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1115","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"21c4c3467b742c5dea5c7d843ab4041e06b18cf72c498c913888d7c0aed5a287","description":"Adversaries may collect data stored in the clipboard from users copying information within or between applications. \n\nFor example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs)\n\nmacOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.(Citation: Operating with EmPyre)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1115","external_id":"T1115"},{"source_name":"CISA_AA21_200B","description":"CISA. (2021, August 20). Alert (AA21-200B) Chinese State-Sponsored Cyber Operations: Observed TTPs. Retrieved June 21, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa21-200b"},{"source_name":"mining_ruby_reversinglabs","description":"Maljic, T. (2020, April 16). Mining for malicious Ruby gems. Retrieved October 15, 2022.","url":"https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems"},{"source_name":"clip_win_server","description":"Microsoft, JasonGerend, et al. (2023, February 3). clip. Retrieved June 21, 2022.","url":"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip"},{"source_name":"MSDN Clipboard","description":"Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.","url":"https://msdn.microsoft.com/en-us/library/ms649012"},{"source_name":"Operating with EmPyre","description":"rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017.","url":"https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0035","name":"Process Access","page":"telemetry/DC0035/","kind":"attack_component","category":"Endpoint activity","description":"One process opening or accessing another process.","collection_focus":"Scope Sysmon ProcessAccess (10) to the selected source/target processes and access rights; retain call-trace fields where emitted.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["source_process_id","target_process_id","granted_access","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1115","id":"T1115","name":"Clipboard Data","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1115","technique_page":"techniques/enterprise/T1115/","page":"detections/enterprise/T1115/","status":"rule_source_available","counts":{"sigma":7,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"214e7e6c-f21b-47ff-bb6f-551b2d143fcf","title":"Clipboard Collection with Xclip Tool - Auditd","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/214e7e6c-f21b-47ff-bb6f-551b2d143fcf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_clipboard_collection.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"f200dc3f-b219-425d-a17e-c38467364816","title":"Clipboard Collection of Image Data with Xclip Tool","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/f200dc3f-b219-425d-a17e-c38467364816.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_clipboard_image_collection.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"ec127035-a636-4b9a-8555-0efd4e59f316","title":"Clipboard Collection with Xclip Tool","status":"test","level":"low","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/ec127035-a636-4b9a-8555-0efd4e59f316.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_clipboard_collection.yml","author":"Pawel Mazur, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC","kind":"sigma"},{"id":"7794fa3c-edea-4cff-bec7-267dd4770fd7","title":"Clipboard Access Via OSAScript","status":"test","level":"medium","logsource":{"product":"macos","category":"process_creation"},"data_path":"data/detection-rules/7794fa3c-edea-4cff-bec7-267dd4770fd7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_clipboard_access_via_osascript.yml","author":"Sohan G (D4rkCiph3r)","kind":"sigma"},{"id":"4cbd4f12-2e22-43e3-882f-bff3247ffb78","title":"PowerShell Get Clipboard","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_module","definition":"0ad03ef1-f21b-4a79-8ce8-e6900c54b65b"},"data_path":"data/detection-rules/4cbd4f12-2e22-43e3-882f-bff3247ffb78.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_module/posh_pm_get_clipboard.yml","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","kind":"sigma"},{"id":"ddeff553-5233-4ae9-bbab-d64d2bd634be","title":"Data Copied To Clipboard Via Clip.EXE","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ddeff553-5233-4ae9-bbab-d64d2bd634be.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_clip_execution.yml","author":"frack113","kind":"sigma"},{"id":"b9aeac14-2ffd-4ad3-b967-1354a4e628c3","title":"PowerShell Get-Clipboard Cmdlet Via CLI","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b9aeac14-2ffd-4ad3-b967-1354a4e628c3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0341","name":"Clipboard Data Access with Anomalous Context","url":"https://attack.mitre.org/detectionstrategies/DET0341","stix_id":"x-mitre-detection-strategy--461e3a2b-2315-4550-abb4-0bd73b0ceaa6","relationship_id":"relationship--120b3e62-84c4-4bf4-884a-97393654e17b","description":"","analytics":[{"id":"AN0965","name":"Analytic 0965","guidance":"Detection of clipboard access via OS utilities (e.g., clip.exe, Get-Clipboard) by non-interactive or abnormal parent processes, potentially chained with staging or exfiltration commands.","url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0965","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Defines how far back to look for parent-child relationships and follow-on network activity."},{"field":"UserContext","description":"Filters based on service vs interactive users to reduce noise."},{"field":"ParentProcessName","description":"Tunable list of expected/benign clipboard accessors."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0965","source_url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0965","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0035","component":"Process Access","name":"WinEventLog:Sysmon","channel":"EventCode=10","platforms":["Windows"],"analytic_id":"AN0965","source_url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0965","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0035/"}]},{"id":"AN0966","name":"Analytic 0966","guidance":"Detection of pbpaste/pbcopy clipboard access by processes without terminal sessions or linked to launch agents, potentially staged for collection.","url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0966","platforms":["macOS"],"tuning":[{"field":"ExecutionChainLength","description":"How many chained or embedded processes to track for correlation."},{"field":"TerminalSession","description":"Whether the pbpaste/pbcopy action is tied to a user terminal."},{"field":"BinaryPath","description":"Adjust if clipboard tooling is relocated (e.g., /opt/empyre/pbpaste)."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"process","platforms":["macOS"],"analytic_id":"AN0966","source_url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0966","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0967","name":"Analytic 0967","guidance":"Detection of xclip or xsel access to clipboard buffers outside of user terminal context, especially when chained to staging (gzip, base64) or network exfiltration (curl, scp).","url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0967","platforms":["Linux"],"tuning":[{"field":"ClipboardCommand","description":"Tool used (xclip, xsel, custom clipboard-read binary)."},{"field":"CorrelationWindow","description":"Temporal window to chain staging or network activity with clipboard access."},{"field":"TTYLinked","description":"Was access linked to interactive user TTY?"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN0967","source_url":"https://attack.mitre.org/detectionstrategies/DET0341#AN0967","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0035","name":"Process Access","tag":"Process Access","page":"telemetry/DC0035/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0004","name":"TinyZBot","url":"https://attack.mitre.org/software/S0004","kind":"malware","description":"[TinyZBot](https://attack.mitre.org/software/S0004) contains functionality to collect information from the clipboard.(Citation: Cylance Cleaver)","relationship_id":"relationship--35ca6c35-f1e9-49b7-a8c9-a67951c57ea0","references":[{"source_name":"Cylance Cleaver","description":"Cylance. (2014, December). Operation Cleaver. Retrieved September 14, 2017.","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}]},{"id":"S0044","name":"JHUHUGIT","url":"https://attack.mitre.org/software/S0044","kind":"malware","description":"A [JHUHUGIT](https://attack.mitre.org/software/S0044) variant accesses a screenshot saved in the clipboard and converts it to a JPG image.(Citation: Unit 42 Playbook Dec 2017)","relationship_id":"relationship--83aac36d-6dfa-4c27-b1b1-c200c9240eb9","references":[{"source_name":"Unit 42 Playbook Dec 2017","description":"Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"id":"S0050","name":"CosmicDuke","url":"https://attack.mitre.org/software/S0050","kind":"malware","description":"[CosmicDuke](https://attack.mitre.org/software/S0050) copies and exfiltrates the clipboard contents every 30 seconds.(Citation: F-Secure Cosmicduke)","relationship_id":"relationship--66625422-17cd-4b04-beb5-fa2eabe350ad","references":[{"source_name":"F-Secure Cosmicduke","description":"F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) collects data from the clipboard.(Citation: ESET RTM Feb 2017)(Citation: Unit42 Redaman January 2019)","relationship_id":"relationship--1e03e95c-1c9a-4fa8-9d6d-b5d244b06509","references":[{"source_name":"ESET RTM Feb 2017","description":"Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"},{"source_name":"Unit42 Redaman January 2019","description":"Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}]},{"id":"S0170","name":"Helminth","url":"https://attack.mitre.org/software/S0170","kind":"malware","description":"The executable version of [Helminth](https://attack.mitre.org/software/S0170) has a module to log clipboard contents.(Citation: Palo Alto OilRig May 2016)","relationship_id":"relationship--a58983e1-45d7-4b45-a578-307659a619dc","references":[{"source_name":"Palo Alto OilRig May 2016","description":"Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.","url":"http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) can extract clipboard data from a compromised host.(Citation: Volexity InkySquid RokRAT August 2021)","relationship_id":"relationship--83f5442e-74c1-4e7b-83d8-9c254543bbac","references":[{"source_name":"Volexity InkySquid RokRAT August 2021","description":"Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}]},{"id":"S0250","name":"Koadic","url":"https://attack.mitre.org/software/S0250","kind":"tool","description":"[Koadic](https://attack.mitre.org/software/S0250) can retrieve the current content of the user clipboard.(Citation: Github Koadic)","relationship_id":"relationship--66440b92-cfed-441c-85fd-1d103684a187","references":[{"source_name":"Github Koadic","description":"Magius, J., et al. (2017, July 19). Koadic. Retrieved September 27, 2024.","url":"https://github.com/offsecginger/koadic"}]},{"id":"S0253","name":"RunningRAT","url":"https://attack.mitre.org/software/S0253","kind":"malware","description":"[RunningRAT](https://attack.mitre.org/software/S0253) contains code to open and copy data from the clipboard.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--d4f4974e-7918-4829-8379-5e2e98f2ae20","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0257","name":"VERMIN","url":"https://attack.mitre.org/software/S0257","kind":"malware","description":"[VERMIN](https://attack.mitre.org/software/S0257) collects data stored in the clipboard.(Citation: Unit 42 VERMIN Jan 2018)","relationship_id":"relationship--5070c502-1f3b-4e8c-8eb5-2ea5379fd8f4","references":[{"source_name":"Unit 42 VERMIN Jan 2018","description":"Lancaster, T., Cortes, J. (2018, January 29). VERMIN: Quasar RAT and Custom Malware Used In Ukraine. Retrieved July 5, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/01/unit42-vermin-quasar-rat-custom-malware-used-ukraine/"}]},{"id":"S0261","name":"Catchamas","url":"https://attack.mitre.org/software/S0261","kind":"malware","description":"[Catchamas](https://attack.mitre.org/software/S0261) steals data stored in the clipboard.(Citation: Symantec Catchamas April 2018)","relationship_id":"relationship--a804782a-fc22-43ab-a561-63007284bdf9","references":[{"source_name":"Symantec Catchamas April 2018","description":"Balanza, M. (2018, April 02). Infostealer.Catchamas. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165711/https://www-west.symantec.com/content/symantec/english/en/security-center/writeup.html/2018-040209-1742-99"}]},{"id":"S0282","name":"MacSpy","url":"https://attack.mitre.org/software/S0282","kind":"malware","description":"[MacSpy](https://attack.mitre.org/software/S0282) can steal clipboard contents.(Citation: objsee mac malware 2017)","relationship_id":"relationship--5a2b7013-a110-4a07-acf6-66a7f159954d","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283) can capture clipboard data.(Citation: Kaspersky Adwind Feb 2016)","relationship_id":"relationship--ac3fb8d5-9d9d-4701-a269-53e838850d71","references":[{"source_name":"Kaspersky Adwind Feb 2016","description":"Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) can hook GetClipboardData function to watch for clipboard pastes to collect.(Citation: GDATA Zeus Panda June 2017)","relationship_id":"relationship--ce378e64-5802-4751-8b8e-d7bf68ce4c6a","references":[{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0331","name":"Agent Tesla","url":"https://attack.mitre.org/software/S0331","kind":"malware","description":"[Agent Tesla](https://attack.mitre.org/software/S0331) can steal data from the victim’s clipboard.(Citation: Talos Agent Tesla Oct 2018)(Citation: Fortinet Agent Tesla April 2018)(Citation: Fortinet Agent Tesla June 2017)(Citation: Bitdefender Agent Tesla April 2020)","relationship_id":"relationship--06dded4b-f28c-45d3-8dc6-097a9a4a3cd6","references":[{"source_name":"Talos Agent Tesla Oct 2018","description":"Brumaghin, E., et al. (2018, October 15). Old dog, new tricks - Analysing new RTF-based campaign distributing Agent Tesla, Loki with PyREbox. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html"},{"source_name":"Fortinet Agent Tesla April 2018","description":"Zhang, X. (2018, April 05). Analysis of New Agent Tesla Spyware Variant. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/analysis-of-new-agent-tesla-spyware-variant.html"},{"source_name":"Fortinet Agent Tesla June 2017","description":"Zhang, X. (2017, June 28). In-Depth Analysis of A New Variant of .NET Malware AgentTesla. Retrieved November 5, 2018.","url":"https://www.fortinet.com/blog/threat-research/in-depth-analysis-of-net-malware-javaupdtr.html"},{"source_name":"Bitdefender Agent Tesla April 2020","description":"Arsene, L. (2020, April 21). Oil & Gas Spearphishing Campaigns Drop Agent Tesla Spyware in Advance of Historic OPEC+ Deal. Retrieved May 19, 2020.","url":"https://labs.bitdefender.com/2020/04/oil-gas-spearphishing-campaigns-drop-agent-tesla-spyware-in-advance-of-historic-opec-deal/"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) steals and modifies data from the clipboard.(Citation: Riskiq Remcos Jan 2018)(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--441ef1f7-79b7-476a-8c1e-943439e65dd1","references":[{"source_name":"Riskiq Remcos Jan 2018","description":"Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.","url":"https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"},{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0334","name":"DarkComet","url":"https://attack.mitre.org/software/S0334","kind":"malware","description":"[DarkComet](https://attack.mitre.org/software/S0334) can steal data from the clipboard.(Citation: Malwarebytes DarkComet March 2018)","relationship_id":"relationship--28b56048-87a7-4204-b55b-3f2f79f9073f","references":[{"source_name":"Malwarebytes DarkComet March 2018","description":"Kujawa, A. (2018, March 27). You dirty RAT! Part 1: DarkComet. Retrieved November 6, 2018.","url":"https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"[KONNI](https://attack.mitre.org/software/S0356) had a feature to steal data from the clipboard.(Citation: Talos Konni May 2017)","relationship_id":"relationship--592df85b-8f0b-46c1-87e6-fa48da9c0ead","references":[{"source_name":"Talos Konni May 2017","description":"Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) can harvest clipboard data on both Windows and macOS systems.(Citation: Github PowerShell Empire)","relationship_id":"relationship--3ca37791-9dad-430f-aee9-0126d13ae932","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0373","name":"Astaroth","url":"https://attack.mitre.org/software/S0373","kind":"malware","description":"[Astaroth](https://attack.mitre.org/software/S0373) collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries. (Citation: Cybereason Astaroth Feb 2019)","relationship_id":"relationship--29bf3ce1-f531-472f-9825-b990aab2f09c","references":[{"source_name":"Cybereason Astaroth Feb 2019","description":"Salem, E. (2019, February 13). ASTAROTH MALWARE USES LEGITIMATE OS AND ANTIVIRUS PROCESSES TO STEAL PASSWORDS AND PERSONAL DATA. Retrieved April 17, 2019.","url":"https://www.cybereason.com/blog/information-stealing-malware-targeting-brazil-full-research"}]},{"id":"S0375","name":"Remexi","url":"https://attack.mitre.org/software/S0375","kind":"malware","description":"[Remexi](https://attack.mitre.org/software/S0375) collects text from the clipboard.(Citation: Securelist Remexi Jan 2019)","relationship_id":"relationship--5940076b-120a-4588-b227-7fe2bc9f7ccd","references":[{"source_name":"Securelist Remexi Jan 2019","description":"Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}]},{"id":"S0381","name":"FlawedAmmyy","url":"https://attack.mitre.org/software/S0381","kind":"malware","description":"[FlawedAmmyy](https://attack.mitre.org/software/S0381) can collect clipboard data.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--e2335bc2-8ad0-484d-89b5-70b05a131296","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409) hijacks the clipboard data by creating an overlapped window that listens to keyboard events.(Citation: ESET Machete July 2019)(Citation: Securelist Machete Aug 2014) ","relationship_id":"relationship--7e05e716-1a86-4f87-9eba-5b5c6ee61b8a","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Securelist Machete Aug 2014","description":"Kaspersky Global Research and Analysis Team. (2014, August 20). El Machete. Retrieved September 13, 2019.","url":"https://securelist.com/el-machete/66108/"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438) has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--40205b23-d3d0-4d6a-a739-7ba2eb061c4f","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0454","name":"Cadelspy","url":"https://attack.mitre.org/software/S0454","kind":"malware","description":"[Cadelspy](https://attack.mitre.org/software/S0454) has the ability to steal data from the clipboard.(Citation: Symantec Chafer Dec 2015)","relationship_id":"relationship--5c859db1-13ba-4bf8-a8d3-7fd99e061c45","references":[{"source_name":"Symantec Chafer Dec 2015","description":"Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.(Citation: Fortinet Metamorfo Feb 2020)(Citation: ESET Casbaneiro Oct 2019)","relationship_id":"relationship--787f09c0-92fe-4208-96e8-86c8e45c9a40","references":[{"source_name":"Fortinet Metamorfo Feb 2020","description":"Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"},{"source_name":"ESET Casbaneiro Oct 2019","description":"ESET Research. (2019, October 3). Casbaneiro: peculiarities of this banking Trojan that affects Brazil and Mexico. Retrieved September 23, 2021.","url":"https://www.welivesecurity.com/2019/10/03/casbaneiro-trojan-dangerous-cooking/"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to steal data from the clipboard of an infected host.(Citation: Kaspersky TajMahal April 2019)\n","relationship_id":"relationship--f283af63-1fdf-49d3-8a56-304c5be07a83","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0530","name":"Melcoz","url":"https://attack.mitre.org/software/S0530","kind":"malware","description":"[Melcoz](https://attack.mitre.org/software/S0530) can monitor content saved to the clipboard.(Citation: Securelist Brazilian Banking Malware July 2020)","relationship_id":"relationship--ce8220fc-98ee-4b48-b98c-8be15a429410","references":[{"source_name":"Securelist Brazilian Banking Malware July 2020","description":"GReAT. (2020, July 14). The Tetrade: Brazilian banking malware goes global. Retrieved November 9, 2020.","url":"https://securelist.com/the-tetrade-brazilian-banking-malware/97779/"}]},{"id":"S0531","name":"Grandoreiro","url":"https://attack.mitre.org/software/S0531","kind":"malware","description":"[Grandoreiro](https://attack.mitre.org/software/S0531) can capture clipboard data from a compromised host.(Citation: IBM Grandoreiro April 2020)","relationship_id":"relationship--9e1742a1-ffc0-4e29-88d2-04ef30a13358","references":[{"source_name":"IBM Grandoreiro April 2020","description":"Abramov, D. (2020, April 13). Grandoreiro Malware Now Targeting Banks in Spain. Retrieved November 12, 2020.","url":"https://securityintelligence.com/posts/grandoreiro-malware-now-targeting-banks-in-spain/"}]},{"id":"S0569","name":"Explosive","url":"https://attack.mitre.org/software/S0569","kind":"malware","description":"[Explosive](https://attack.mitre.org/software/S0569) has a function to use the OpenClipboard wrapper.(Citation: CheckPoint Volatile Cedar March 2015) ","relationship_id":"relationship--b2553142-9377-42b3-9fd6-50fcbd4263b3","references":[{"source_name":"CheckPoint Volatile Cedar March 2015","description":"Threat Intelligence and Research. (2015, March 30). VOLATILE CEDAR. Retrieved February 8, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"}]},{"id":"S0652","name":"MarkiRAT","url":"https://attack.mitre.org/software/S0652","kind":"malware","description":"[MarkiRAT](https://attack.mitre.org/software/S0652) can capture clipboard content.(Citation: Kaspersky Ferocious Kitten Jun 2021)","relationship_id":"relationship--e94dc1ba-678b-4c09-9c29-515a5d277ec4","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","description":"GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) has the ability to capture and store clipboard data.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)","relationship_id":"relationship--744da30b-d540-4512-85c7-d32310e2aa78","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Talent-Jump Clambling February 2020","description":"Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can monitor Clipboard text and can use `System.Windows.Forms.Clipboard.GetText()` to collect data from the clipboard.(Citation: Github_SILENTTRINITY)  ","relationship_id":"relationship--1ff3e957-905e-4d2b-b893-c280052bbe30","references":[{"source_name":"Github_SILENTTRINITY","description":"byt3bl33d3r. (n.d.). SILENTTRINITY. Retrieved September 12, 2024.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY"}]},{"id":"S1066","name":"DarkTortilla","url":"https://attack.mitre.org/software/S1066","kind":"malware","description":"[DarkTortilla](https://attack.mitre.org/software/S1066) can download a clipboard information stealer module.(Citation: Secureworks DarkTortilla Aug 2022)","relationship_id":"relationship--778aa9ba-0561-44bd-a28f-94ba2b12f78b","references":[{"source_name":"Secureworks DarkTortilla Aug 2022","description":"Secureworks Counter Threat Unit Research Team. (2022, August 17). DarkTortilla Malware Analysis. Retrieved November 3, 2022.","url":"https://www.secureworks.com/research/darktortilla-malware-analysis"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"[DarkGate](https://attack.mitre.org/software/S1111) starts a thread on execution that captures clipboard data and logs it to a predefined log file.(Citation: Ensilo Darkgate 2018)(Citation: Rapid7 BlackBasta 2024)","relationship_id":"relationship--baefb35b-634a-42d4-9cec-7cf1f5e1b324","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"},{"source_name":"Rapid7 BlackBasta 2024","description":"McGraw, T. (2024, December 4). Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware. Retrieved December 9, 2024.","url":"https://www.rapid7.com/blog/post/2024/12/04/black-basta-ransomware-campaign-drops-zbot-darkgate-and-custom-malware/"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122) has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.(Citation: ESET Security Mispadu Facebook Ads 2019)","relationship_id":"relationship--d9ce0226-58f6-4907-a20f-6c821b537f7f","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","description":"ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"}]},{"id":"S1146","name":"MgBot","url":"https://attack.mitre.org/software/S1146","kind":"malware","description":"[MgBot](https://attack.mitre.org/software/S1146) can capture clipboard data.(Citation: ESET EvasivePanda 2023)(Citation: Symantec Daggerfly 2023)","relationship_id":"relationship--85ec27f0-77c3-4896-9934-cac7b73c87e9","references":[{"source_name":"ESET EvasivePanda 2023","description":"Facundo Muñoz. (2023, April 26). Evasive Panda APT group delivers malware via updates for popular Chinese software. Retrieved July 25, 2024.","url":"https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/"},{"source_name":"Symantec Daggerfly 2023","description":"Threat Hunter Team. (2023, April 20). Daggerfly: APT Actor Targets Telecoms Company in Africa. Retrieved July 25, 2024.","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) can capture content from the clipboard.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--551f1eb5-0cb9-4f5b-a97d-c61c081eea9e","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1207","name":"XLoader","url":"https://attack.mitre.org/software/S1207","kind":"malware","description":"[XLoader](https://attack.mitre.org/software/S1207) can collect data stored in the victim's clipboard.(Citation: Google XLoader 2017)(Citation: Netskope XLoader 2022)","relationship_id":"relationship--6ce17afb-98fb-4b43-b99d-2eaa3c88a25e","references":[{"source_name":"Netskope XLoader 2022","description":"Gustavo Palazolo, Netskope. (2022, March 11). New Formbook Campaign Delivered Through Phishing Emails. Retrieved March 11, 2025.","url":"https://www.netskope.com/blog/new-formbook-campaign-delivered-through-phishing-emails"},{"source_name":"Google XLoader 2017","description":"Nart Villeneuve, Randi Eitzman, Sandor Nemes & Tyler Dean, Google Cloud. (2017, October 5). Significant FormBook Distribution Campaigns Impacting the U.S. and South Korea. Retrieved March 11, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/formbook-malware-distribution-campaigns/"}]},{"id":"S1226","name":"BOOKWORM","url":"https://attack.mitre.org/software/S1226","kind":"malware","description":"[BOOKWORM](https://attack.mitre.org/software/S1226) has used its KBLogger.dll module to steal data saved to the clipboard. (Citation: Unit42 Bookworm Nov2015)","relationship_id":"relationship--f43a1b3a-432b-47e7-8da6-4bac45d1ae4e","references":[{"source_name":"Unit42 Bookworm Nov2015","description":"Robert Falcone, Mike Scott, Juan Cortes. (2015, November 10). Bookworm Trojan: A Model of Modular Architecture. Retrieved July 21, 2025.","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}]},{"id":"S1233","name":"PAKLOG","url":"https://attack.mitre.org/software/S1233","kind":"malware","description":"[PAKLOG](https://attack.mitre.org/software/S1233) has monitored and extracted clipboard contents.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--601ae14e-841f-4c18-bbe5-b570cb7d8d26","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has stolen data from the clipboard using the Python project “pyperclip”.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [InvisibleFerret](https://attack.mitre.org/software/S1245) has also captured clipboard contents during copy and paste operations.(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024)","relationship_id":"relationship--e40276e4-dc1f-4ae9-a172-d5fae0d674e7","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]}],"actors":[{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) has used infostealer tools to copy clipboard data.(Citation: Symantec Crambus OCT 2023)","relationship_id":"relationship--c3221e04-0e40-4454-acf0-46b1e450c0a0","references":[{"source_name":"Symantec Crambus OCT 2023","description":"Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) used a Trojan called KEYLIME to collect data from the clipboard.(Citation: FireEye APT38 Oct 2018)","relationship_id":"relationship--b2a83e1d-f6e8-4cdc-a96e-7bca9a48dfb2","references":[{"source_name":"FireEye APT38 Oct 2018","description":"FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used tools capable of stealing contents of the clipboard.(Citation: Symantec Chafer February 2018)","relationship_id":"relationship--0f81e969-dfc4-4d37-8664-59c31bd7116c","references":[{"source_name":"Symantec Chafer February 2018","description":"Symantec. (2018, February 28). Chafer: Latest Attacks Reveal Heightened Ambitions. Retrieved May 22, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has the ability to steal data from the clipboard.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--268e43b1-56fb-42ff-8b2b-d7fb06d11f65","references":[{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]}],"mitigations":[],"candidates":[{"id":"0cd14633-58d4-4422-9ede-daa2c9474ae7","name":"Utilize Clipboard to store or execute commands from","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml","description":"Add data to clipboard to copy off or execute commands from.\n","inputs":{},"dependencies":[],"source_definition_sha256":"2cd7af28af3dc9af2590fb9dc7e04004ce0bab669d32c2ee96c59a0b4f40fe12"},{"id":"1ac2247f-65f8-4051-b51f-b0ccdfaaa5ff","name":"Execute commands from clipboard","platforms":["macos"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml","description":"Echo a command to clipboard and execute it","inputs":{},"dependencies":[],"source_definition_sha256":"401a9b69dc5f447780b2fc1422560cffe9113220b694a962ad9372fe94ffcf2a"},{"id":"9c8d5a72-9c98-48d3-b9bf-da2cc43bdf52","name":"Collect Clipboard Data via VBA","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml","description":"This module copies the data stored in the user's clipboard and writes it to a file, $env:TEMP\\atomic_T1115_clipboard_data.txt\n","inputs":{"ms_product":{"description":"Maldoc application Word","type":"string","default":"Word"}},"dependencies":[{"description":"Microsoft #{ms_product} must be installed\n"}],"source_definition_sha256":"730e6a98f8c4a2e7aad203d47081737eaceb086edae884474badec6c94d9cfea"},{"id":"d6dc21af-bec9-4152-be86-326b6babd416","name":"Execute Commands from Clipboard using PowerShell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml","description":"Utilize PowerShell to echo a command to clipboard and execute it\n","inputs":{},"dependencies":[],"source_definition_sha256":"74f513f75bd72339cd3740ab462b38e355cb832c93965d274566a7d9f7f7221f"},{"id":"ee363e53-b083-4230-aff3-f8d955f2d5bb","name":"Add or copy content to clipboard with xClip","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1115/T1115.yaml","description":"Utilize Linux Xclip to copy history and place in clipboard then output to a history.txt file. Successful execution will capture history and output to a file on disk.\n","inputs":{},"dependencies":[],"source_definition_sha256":"86a613c8c100ff7f41ad894324328c77aef08e0b4b659165402265badb9d744d"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1565.002":"/ttp-simulation/techniques/enterprise/T1565.002/","T1115":"/ttp-simulation/techniques/enterprise/T1115/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1115","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0035","collector":"illustrative-lab-collector","observation":{"source_process_id":4200,"target_process_id":4300,"granted_access":"0x1000","action":"open_process"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}