PowerShell Clipboard Data Harvesting via Get-Clipboard or WinForms

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•0

This rule detects PowerShell activity where scripts or commands are used to interact with the Windows clipboard, such as retrieving text or data. This is often indicative of reconnaissance or data theft attempts, where an adversary aims to capture credentials, secrets, or sensitive information stored in the clipboard by a user.