Phantom Stealer Clipboard API Access via explorer.exe (T1115)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•4•0•4

Detects when 'explorer.exe' performs clipboard access actions such as opening, getting data from, or setting a clipboard viewer. While 'explorer.exe' is a legitimate Windows process, unusual or excessive clipboard activity from it could indicate suspicious behavior, potentially related to data collection or manipulation.