BirdCall Collects Clipboard Content

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•5

Detects an unsigned process using clipboard-related command-line or module indicators before writing local collection data. The rule specifically looks for process image names containing "bird", "call", "update", or "service" (case-insensitive) combined with command-line arguments or module indicators related to clipboard access such as "clipboard", "GetClipboardData", "OpenClipboard", or "CF_UNICODETEXT".