[IC] - Threats Based on Clipboard action
AI is becoming a key part of detection and response, but it’s important not to overlook simpler techniques that are still effective. In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed. The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
Microsoft Sentinel (KQL)
