Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
133 detections
Filters
Last updated
All Time
Detection languages
48
43
12
11
6
Contributors
33
24
17
10
8
Categories
53
48
29
23
19
Platforms
107
21
18
4
1
Products / Services
28
23
14
9
8
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects obfuscated PowerShell commands that utilize 'clip.exe' to interact with the clipboard, often as part of an obfuscation technique like those used by Invoke-Obfuscation. The rule specifically looks for patterns where 'echo' is piped to 'clip' and then followed by terms related to 'Clipboard' or 'invoke' with potential character obfuscation.
Detects obfuscated PowerShell scripts that utilize 'clip.exe' to interact with the clipboard, potentially for defense evasion or data manipulation. The rule specifically looks for the pattern 'echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?)' within PowerShell script block text, indicating an attempt to pipe output to clip.exe and then interact with the clipboard or invoke further commands.
Detects obfuscated PowerShell commands that leverage `clip.exe` to retrieve content from the clipboard for execution. This technique is often used to evade detection by hiding malicious scripts in the clipboard until runtime.
Detects the execution of 'clip.exe' to copy data to the clipboard. Adversaries may use this utility to collect sensitive information that users have copied within or between applications.
Detects usage of the 'Get-Clipboard' cmdlet via CLI
Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations.
A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.
Page 7 of 7