StealC Clipboard Data Harvesting via OpenClipboard and GetClipboardData

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

This rule detects attempts by processes located outside of standard system directories (C:\Windows, C:\Program Files) but within user or program data directories (C:\Users, C:\ProgramData, C:\AppData) to access clipboard data. This could indicate malicious activity where an unauthorized application is trying to exfiltrate sensitive information from the clipboard.