XWorm RAT - Clipboard Hijacking via WinAPI Monitoring Loop

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

This rule detects processes that exhibit behavior consistent with XWorm RAT's clipboard hijacking capabilities. It identifies processes making persistent OpenClipboard API calls or showing unusual access patterns to clipboard-related registry keys, specifically looking for modifications to the 'Run' registry key with data containing 'xworm', 'clipboard', or 'clip'. Common legitimate processes are excluded to reduce false positives.