Clipboard Data Exfil via HTTP POST

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•7

This rule detects attempts to exfiltrate clipboard data over HTTP using a POST request. It specifically looks for HTTP POST requests where the URI or content contains the string "clipboard" (case-insensitive). This behavior is indicative of malware or malicious scripts trying to steal sensitive information copied by the user.