MITRE ATT&CKtechnique

T1115 Clipboard Data

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Collection
Platforms
Linux, macOS, Windows
Version
1.2
Created
2017-05-31

Description

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation). macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (46)

  • S1245 InvisibleFerret software (malware)
  • S1233 PAKLOG software (malware)
  • S1226 BOOKWORM software (malware)
  • S1207 XLoader software (malware)
  • S1149 CHIMNEYSWEEP software (malware)
  • S1146 MgBot software (malware)
  • S1122 Mispadu software (malware)
  • S1111 DarkGate software (malware)
  • S1066 DarkTortilla software (malware)
  • C0014 Operation Wocao campaign
  • S0692 SILENTTRINITY software (tool)
  • S0660 Clambling software (malware)
  • S0652 MarkiRAT software (malware)
  • S0569 Explosive software (malware)
  • S0530 Melcoz software (malware)
  • S0531 Grandoreiro software (malware)
  • S0467 TajMahal software (malware)
  • S0455 Metamorfo software (malware)
  • S0454 Cadelspy software (malware)
  • S0438 Attor software (malware)
  • S0409 Machete software (malware)
  • G0094 Kimsuky group
  • S0381 FlawedAmmyy software (malware)
  • S0373 Astaroth software (malware)
  • S0375 Remexi software (malware)
  • S0363 Empire software (tool)
  • G0087 APT39 group
  • S0356 KONNI software (malware)
  • G0082 APT38 group
  • S0330 Zeus Panda software (malware)
Show all 46 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-637 Collect Data from Clipboard attack pattern

References