T1115.md

T1115 - Clipboard Data

Description from ATT&CK

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

In Windows, Applications can access clipboard data by using the Windows API.(Citation: MSDN Clipboard) OSX provides a native command, pbpaste, to grab clipboard contents.(Citation: Operating with EmPyre)

Atomic Tests

• Atomic Test #1 - Utilize Clipboard to store or execute commands from

• Atomic Test #2 - PowerShell

Atomic Test #1 - Utilize Clipboard to store or execute commands from

Add data to clipboard to copy off or execute commands from.

Supported Platforms: Windows

Attack Commands: Run with command_prompt!

dir | clip
echo "T1115" > %temp%\T1115.txt
clip < %temp%\T1115.txt

Cleanup Commands:

del %temp%\T1115.txt >nul 2>&1

Atomic Test #2 - PowerShell

Utilize PowerShell to echo a command to clipboard and execute it

Supported Platforms: Windows

Attack Commands: Run with powershell!

echo Get-Process | clip
Get-Clipboard | iex