MITRE ATT&CK T1115 Clipboard Data: Detecting Data Gathering

The clipboard is where passwords, API keys, recovery codes and wallet addresses pass in plain text on their way from a password manager or console to wherever they are pasted, and any process in the user's session can usually read it. MITRE ATT&CK T1115 Clipboard Data, in the Collection tactic (TA0009), covers adversaries collecting data that users copy within or between applications, for example with clip.exe or the PowerShell Get-Clipboard cmdlet on Windows and pbpaste on macOS, and in some cases monitoring the clipboard and replacing its contents. ATT&CK v20 lists Linux, macOS and Windows as platforms, no sub-techniques and no mitigations, stating that the technique cannot be easily mitigated with preventive controls. This guide is for detection engineers and endpoint teams. For controlling what users themselves copy out of sensitive apps, see the Endpoint DLP Guide; for the mobile equivalent, see Mobile T1414 Clipboard Data.

Key takeaways

• Copy and paste moves secrets. Password managers, secrets consoles and cloud key pages all push credentials through the clipboard, so clipboard theft is credential theft for both people and non-human identities.
• Theft and swap are different threats. Most malware reads the clipboard; clippers such as Mispadu replace copied wallet addresses so payments go to the adversary, which ATT&CK links to T1565.002 Transmitted Data Manipulation.
• The API call is normal, the context is not. ATT&CK's DET0341 looks for clipboard utilities used by non-interactive or unusual parent processes, and for clipboard access chained with staging or exfiltration.
• Shrink the clipboard's memory. Windows clipboard history and cross-device sync can be turned off by policy, and password managers can clear copied values after a short time.
• Remove the need to copy. Autofill, short-lived tokens and workload identity federation mean fewer secrets ever reach the clipboard.

What the technique covers

ATT&CK describes adversaries collecting clipboard data from users copying information within or between applications. On Windows that includes clip.exe and Get-Clipboard; on macOS and Linux, commands such as pbpaste. Malware more often calls clipboard APIs directly, and some families poll the clipboard on a timer or register to be notified on every change. Clipboard collection is commonly bundled with keylogging (T1056.001) and screen capture (T1113 Screen Capture), because together they capture what a user types, copies and sees.

How adversaries use it: cases from ATT&CK

• Operation Wocao (C0014): the actors collected clipboard data in plaintext during an espionage campaign.
• APT38 (G0082): used a Trojan called KEYLIME to collect data from the clipboard, in a group focused on financial theft.
• Kimsuky (G0094), OilRig (G0049) and APT39 (G0087): each recorded using tools that steal clipboard contents, showing that state espionage groups treat it as routine collection.
• InvisibleFerret (S1245): stole clipboard data using the Python pyperclip library. ATT&CK's sources tie it to the fake recruiter activity described in the Contagious Interview Threat Actor Profile Guide, which targets developers who often handle keys and wallet credentials.
• Mispadu (S1122): can capture and replace Bitcoin wallet data in the clipboard, the classic clipper pattern. See the Crypto Scam and Drainer Guide.
• Commodity tooling: Agent Tesla, Remcos, DarkGate and post-exploitation frameworks such as Empire and SILENTTRINITY all include clipboard collection, so it appears in both crimeware and targeted intrusions.

What to detect and where

ATT&CK v20 detection strategy DET0341, Clipboard Data Access with Anomalous Context, has three analytics:

Rules that work in practice

• Clipboard tools from the wrong parent: Get-Clipboard in PowerShell launched by an Office application, script host, scheduled task or service, or pbpaste launched by a launch agent. Enable PowerShell Script Block Logging (Event ID 4104) so Get-Clipboard and .NET clipboard calls inside scripts are visible.
• Clipboard then send: a clipboard read followed within seconds by encoding, writing to a staging file, or an outbound connection from the same process tree.
• Repeated reads: the same process invoking clipboard utilities or scripts on a timer, which is how polling malware shows up when it uses tools rather than APIs.
• Endpoint vendor analytics: malware that calls clipboard APIs directly will not create a clip.exe or pbpaste process. Rely on EDR behavioural detections for API-level clipboard monitoring and on the surrounding behaviour: an unsigned binary in a user directory with persistence, keylogging hooks and periodic outbound traffic.
• Clipper signals: on wallet and payment workflows, a pasted destination address that differs from the one copied. Wallet software that shows and asks users to confirm the full address gives users the chance to catch it.

Noise and baselining

Clipboard access is constant on interactive desktops: every editor, browser, remote desktop client, clipboard manager and password manager uses it. Do not alert on clipboard API use by interactive GUI applications. Focus on non-interactive parents, unsigned binaries, scripts and the chaining behaviour above, and allowlist approved automation and remote desktop tools by publisher and path.

Reducing exposure

ATT&CK lists no mitigation for T1115. The measures below are NHI Mgmt Group recommendations, with Windows policy details from Microsoft's documentation.

Clipboard history and sync are convenience features, so check with users before turning them off broadly. A common compromise is to disable both on privileged access workstations, developer machines that handle production secrets, and finance endpoints, and to leave them on elsewhere. For password manager policy, see the Securing the password manager (enterprise) itself guide.

Where identity fits

Clipboard theft is one of the simplest routes to non-human identity credentials. Developers and administrators copy cloud access keys, personal access tokens, database connection strings and client secrets from consoles and vaults into terminals and configuration files. Any of those values read from the clipboard is immediately usable. Reduce copying by injecting secrets at runtime from a vault, using workload identity federation instead of static keys, and using command-line tools that read from the vault directly. If a host is found infected with clipboard-capable malware, treat every secret copied on it during the infection window as exposed and rotate it.

How to put it in place

1. Turn on telemetry: process creation with command lines on all platforms, PowerShell Script Block Logging on Windows, and the macOS unified log and Linux auditd execve feeds ATT&CK names.
2. Deploy DET0341-style rules in alert-only mode: clipboard tools under non-interactive parents, and clipboard reads chained with encoding or outbound transfer. Tune for two to four weeks.
3. Apply clipboard policies to high-risk groups: disable clipboard history and cross-device sync on privileged, developer and finance endpoints through Group Policy or MDM, starting with a pilot group.
4. Configure password manager clearing and autofill: set clipboard clearing in the managed policy and promote autofill.
5. Test: with approval, run a benign script that reads the clipboard from a scheduled task and posts it to a test endpoint, on each platform, and confirm detection. Validate the policy by copying text and pressing Win+V: with history disabled no items should appear and the setting is greyed out.
6. Roll back: clipboard policies take effect immediately and can be reverted per group; detection rules can be lowered in severity rather than disabled while tuning.

Decision guidance

• Disable history broadly or selectively: broad disablement removes a convenience many users rely on; selective disablement on high-risk endpoints gets most of the benefit with little friction.
• Detection or DLP: endpoint DLP can restrict users copying classified content out of protected apps; it does not stop malware reading the clipboard. Use detection for T1115 and DLP for user data movement.
• Small organisations: password manager autofill and clearing, EDR defaults, and clipboard history off on admin machines.
• Large organisations: add custom chained detections, clipboard redirection policy for remote sessions to sensitive systems, and secret delivery that avoids copy and paste.

Measurement

• Policy coverage: share of privileged, developer and finance endpoints with clipboard history and cross-device sync disabled.
• Autofill adoption: share of password manager fills done by autofill rather than copy.
• Detection rate: share of authorised clipboard collection tests detected per platform, and time to alert.
• Rotation after exposure: time from confirming clipboard-capable malware on a host to rotating secrets used there.
• Noise: weekly false positives from clipboard rules after tuning.

Common failure patterns

• Alerting on clip.exe only: most malware calls clipboard APIs directly, so tool-based rules alone catch little.
• Ignoring the clipboard in incident scoping: rotating passwords typed on an infected host but not keys and tokens that were copied there.
• Copy-paste secret workflows: runbooks that tell engineers to copy production keys from a console into a terminal.
• Cloud clipboard on admin machines: secrets copied on a privileged workstation synchronised to a personal or less protected device.
• No address confirmation: payment and wallet workflows that never ask users to check the full pasted destination, leaving clippers undetected.

Framework mapping

Practitioner checklist

• Collect process creation with command lines and PowerShell Script Block Logging.
• Alert on clipboard utilities run by non-interactive or unusual parent processes.
• Alert on clipboard reads chained with encoding, staging or outbound transfer.
• Disable Windows clipboard history and cross-device sync on privileged, developer and finance endpoints.
• Enforce password manager clipboard clearing and promote autofill.
• Restrict clipboard redirection into remote sessions on sensitive systems.
• Replace copy and paste secret workflows with runtime injection or federation.
• Include copied secrets in rotation scope during incident response.

Standards and references

• MITRE ATT&CK: T1115 Clipboard Data
• MITRE ATT&CK: TA0009 Collection
• Microsoft Learn: Policy CSP Experience (AllowClipboardHistory)
• Microsoft Learn: Policy CSP Privacy (AllowCrossDeviceClipboard)
• Microsoft Learn: Sysmon
• NIST: SP 800-53 Rev 5 Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: ATT&CK Collection Tactic Guide, MITRE ATT&CK T1056 Input Capture, T1555 Credentials from Password Stores Defensive Guide, Insider Data Theft Guide, Infostealer Threat Guide.