Rokarolla Clipboard Hijacking - Crypto Address Replacement via Unusual Process
Detects unauthorized processes monitoring the system clipboard and replacing content with cryptocurrency addresses. This behavior is indicative of clipboard hijacker malware or banking trojans (such as Rokarolla) attempting to redirect funds by modifying the address in the clipboard.
Microsoft Sentinel (KQL)
