Clipboard Data (T1115) is a collection technique. MITRE lists Linux, macOS and Windows.
People copy passwords, API keys, account numbers and snippets of documents all day. The clipboard is shared memory that other programs running as the same user can read.
How attackers use it
MITRE describes adversaries collecting data stored in the clipboard from users copying information within or between applications. On Windows, the clip.exe utility or the Get-Clipboard PowerShell cmdlet can read it. Adversaries may also monitor the clipboard and replace its contents with their own data, which MITRE connects to transmitted data manipulation. On macOS and Linux, commands such as pbpaste can grab the contents.
The replacement case is worth a thought. If a user copies a payment address or a command, a swap can change where money goes or what gets run.
How to detect it
MITRE's strategy is Clipboard Data Access with Anomalous Context. Analytics describe:
- Windows: clipboard access through clip.exe or Get-Clipboard by non-interactive or abnormal parent processes, possibly chained with staging or exfiltration commands.
- macOS: pbpaste or pbcopy access by processes without terminal sessions or those linked to launch agents.
- Linux: xclip or xsel access to clipboard buffers outside a user terminal context, especially chained with staging tools such as gzip or base64, or network exfiltration through curl or scp.
The signal is the parent and the chain. A user typing pbpaste in a terminal is ordinary. A launch agent calling it every few seconds and piping to a network tool is not. Process creation logs with parent and command line, such as Security event 4688 on Windows or Sysmon event ID 1, cover this.
How to reduce the risk
MITRE does not list a formal mitigation for this technique. General practice that fits the description:
- Use a password manager with auto-clear of the clipboard, so secrets do not linger.
- Limit which scripting tools can run unattended on endpoints.
- Verify pasted payment details and commands before acting on them.
Quick check
Which tools does MITRE name for reading the clipboard?
clip.exe and Get-Clipboard on Windows, and pbpaste on macOS. On Linux, xclip and xsel appear in the detection analytics.
What is the clipboard replacement risk?
An adversary may monitor the clipboard and swap in their own data, changing what a user pastes.
Sources
- MITRE ATT&CK, Clipboard Data (T1115)
