SysmonObject Access

Event 24: Clipboard Change

Logs when the system clipboard contents change. Generates an event when the clipboard text changes.

Technical Details

Sysmon Source

Event ID: 24

Sysmon- Object Access

Event Description

Logs when the system clipboard contents change. Generates an event when the clipboard text changes.

Key Log Fields

  • UtcTime - UTC timestamp of clipboard activity
  • ProcessGuid - Process GUID that accessed clipboard
  • ProcessId - Process ID
  • Image - Process executable path
  • Session - Session ID
  • ClientInfo - Client information
  • Hashes - Hash of clipboard content if applicable
  • Archived - Whether clipboard content was archived

MITRE ATT&CK® Mapping (1)

T1115collection
Clipboard Data

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>.(Citation: MSDN Clipboard)(Citation: clip_win_server)(Citation: CISA_AA21_200B) Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002)).(Citation: mining_ruby_reversinglabs) macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.(Citation: Operating with EmPyre)

Contents