StealC Clipboard Harvesting via OpenClipboard/GetClipboardData from Non-Interactive Process
Detects potential clipboard harvesting behavior indicative of information stealers like StealC. The rule monitors for processes executing from suspicious, user-writable directories (e.g., AppData, Temp) that perform clipboard access operations while lacking typical interactive process characteristics.
YARA-L
