Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
133 detections
Filters
Last updated
All Time
Detection languages
48
43
12
11
6
Contributors
33
24
17
10
8
Categories
53
48
29
23
19
Platforms
107
21
18
4
1
Products / Services
28
23
14
9
8
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
This rule detects potential web skimmer activity where a user's browser performs a network connection to known payload delivery hosts (e.g., paste.sh or Google Sheets API) followed by a clipboard modification event on the same device within a one-hour window. This behavior is consistent with malicious scripts attempting to replace copied cryptocurrency wallet addresses with an attacker-controlled address.
Detects frequent execution of the 'pbpaste' command on macOS, which is used to read clipboard contents. An unusually high volume of executions within a short window can indicate automated data collection or clipboard monitoring, a common technique for credential harvesting or exfiltration of sensitive information copied by the user.
Detects frequent execution of the 'pbpaste' command on macOS, which is used to read clipboard contents. An unusually high volume of executions within a short window can indicate automated data collection or clipboard monitoring, a common technique for credential harvesting or exfiltration of sensitive information copied by the user.
Detects CoolClient's data-collection module: co-occurring keylogging hook installation, clipboard access, and Chromium credential-store file access from an unsigned/non-OS-vendor process.
Correlates at least 3 of 4 distinct Abyssos background polling threads (clipboard, process list, network connections, screen capture) launched by the same unsigned/unknown-signature parent process within the same 5-minute window.
Detects the clipboard_start/clipboard_stop/clipboard_data C2 command schema used by ChonkyChicken for clipboard monitoring.
This KQL detects activity associated with network traffic to known C2 infrastructure (45.146.252.17), suspicious Node/NPM execution chains and dropped payload/marker files. Also looks for indicators of remote control, clipboard access, screenshot/desktop-control packages, Socket.IO C2 traffic, and file/browser/wallet data exfiltration behavior.
Detects potential execution of malicious HTA files or encoded PowerShell commands initiated from the Windows Explorer Run dialog. This behavior is consistent with 'ClickFix' social engineering attacks where users are tricked into copying and pasting commands into the Run dialog to bypass security controls under the guise of verifying a fake CAPTCHA.
Detects processes attempting to interact with the macOS NSPasteboard (clipboard) that are not typically associated with standard clipboard utility operations like Maccy, pbcopy, or pbpaste. This may indicate unauthorized data collection or exfiltration of sensitive information copied to the system clipboard.
Detects outbound HTTP requests matching the VPN Go clipboard-stealer exfiltration pattern: a request to /html/continue.php carrying the uid, part, total, and data query parameters used to reassemble chunked clipboard contents server-side. URI-pattern based, so it catches infrastructure rotation beyond the known IOC hosts.
Clipboard hijacking malware for cryptocurrency address substitution
Detects the loading of DLLs by rundll32.exe from non-standard user-writable directories (AppData, Temp), often associated with infostealer clipper plugins such as clip64.dll. These patterns are commonly used by malware families like Amadey, LokiBot, and Lumma Stealer to maintain persistence or execute malicious functionality via legitimate Windows binaries.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects clipboard access operations (Read/Write) initiated by common web browsers (Chrome, Edge, Brave, Electron-based apps) when running with specific command-line arguments typically associated with renderer or extension processes. This can indicate malicious code or browser extensions attempting to monitor or steal sensitive clipboard content.
Clipboard hijacking malware for cryptocurrency address substitution
Clipboard hijacking malware for cryptocurrency address substitution
Detects clipboard access operations (Read/Write) initiated by common web browsers (Chrome, Edge, Brave, Electron-based apps) when running with specific command-line arguments typically associated with renderer or extension processes. This can indicate malicious code or browser extensions attempting to monitor or steal sensitive clipboard content.
Detects repeated execution of the 'pbpaste' command initiated by the 'Finder' application where the parent process path originates from within the '/Library/Application Support/' directory. This behavior is indicative of a potentially malicious macOS plug-in or background component attempting to periodically monitor and extract clipboard data.
This rule detects processes associated with scripting languages like Python and Node.js that are attempting to access clipboard data or use clipboard-related libraries (e.g., pyperclip, win32clipboard, xclip). This behavior is common in info-stealer malware, such as InvisibleFerret, which uses the clipboard to harvest sensitive user data.
Clipboard hijacking malware for cryptocurrency address substitution
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Page 2 of 7