T1115: Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.[1][2][3] Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation).[4]
macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.[5]
Analyst context for executives and security teams
Clipboard Data matters because users often copy high-value information between applications: passwords, recovery codes, account numbers, command output, file paths, or business data. ATT&CK lists this as a collection technique across Windows, macOS, and Linux. For leaders, the key issue is not the clipboard itself but whether endpoint monitoring, user workflows, and incident response playbooks can recognize suspicious clipboard access in context before copied data becomes useful to an intruder.
Executive priority
Treat this as a low-friction collection behavior that can undermine identity security and sensitive-data handling without requiring a major exploit. Priority should be highest where staff routinely copy credentials, financial data, customer data, operational commands, or administrative tokens between tools. Ask whether the organization has evidence that clipboard access by scripts, malware, remote access tools, or post-exploitation frameworks would be visible during an investigation. This also supports audit and compliance discussions around endpoint logging, privileged-user handling, and proof of monitoring for data collection behavior.
Technical view
T1115 is an enterprise collection technique for Linux, macOS, and Windows. MITRE notes Windows access through clip.exe or Get-Clipboard, and macOS/Linux access through commands such as pbpaste. ATT&CK does not provide official detection text, but the related detection strategy DET0341, “Clipboard Data Access with Anomalous Context,” indicates that context is central: suspicious parent process, scripting engine use, remote access tooling, unusual user/session context, or repeated clipboard reads may matter more than the clipboard command alone. Relationship context shows use by multiple malware families, RATs, post-exploitation frameworks, and named groups/campaigns, so SOC teams should validate coverage across both commodity tooling and more targeted intrusion tradecraft without assuming any specific actor is present.
Likely telemetry
- Endpoint process creation events with command line, parent process, user, host, and session context for clip.exe, Get-Clipboard, pbpaste, and similar clipboard utilities
- PowerShell execution telemetry where Get-Clipboard or clipboard-related collection is observable
- Script interpreter activity on Windows, macOS, and Linux when paired with clipboard collection behavior
- Endpoint detection telemetry for applications or processes accessing clipboard APIs where available
- Remote access tool, RAT, or post-exploitation framework activity correlated with clipboard access
Detection direction
- Start with DET0341-style validation: detect clipboard access with anomalous context rather than alerting on every legitimate clipboard operation.
- Tune for process lineage: scripting engines, Office-spawned processes, remote shells, unsigned or unexpected binaries, and known administration frameworks invoking clipboard utilities should receive higher scrutiny.
- On Windows, validate visibility for clip.exe and PowerShell Get-Clipboard usage; on macOS/Linux, validate visibility for pbpaste and equivalent command execution.
- Correlate clipboard access with collection-stage and post-compromise signals, especially RAT/backdoor behavior reflected in the ATT&CK software relationships.
- Expect false positives from normal user activity, help desk work, developer workflows, and administrative scripting; require context such as non-interactive sessions, unusual parents, repeated reads, or follow-on transfer behavior.
Mitigation priorities
- Reduce the business need to copy sensitive secrets through the clipboard, especially for privileged users and high-risk business processes.
- Prioritize endpoint logging and retention for process creation, command line, PowerShell/script activity, and user session context across Windows, macOS, and Linux systems in scope.
- Apply least privilege and application control principles to limit unnecessary script and post-exploitation tooling execution where operationally feasible.
- Include clipboard collection in incident response triage checklists when investigating RATs, spyware, backdoors, or post-exploitation frameworks listed in the ATT&CK relationships.
- Use user guidance and secure workflow design for credentials, financial data, and regulated information so clipboard exposure is minimized and defensible for compliance evidence.
Analyst notes and limits
ATT&CK relationship context is broad: the technique is associated with Operation Wocao; groups including OilRig, APT38, APT39, and Kimsuky; and many software entries such as Agent Tesla, Remcos, DarkComet, Empire, Koadic, ROKRAT, jRAT, MacSpy, and others. This breadth supports treating clipboard collection as a common collection behavior, not as actor-specific evidence. The most useful local analysis will come from determining which business roles copy sensitive data and whether endpoint telemetry can distinguish normal interactive use from suspicious collection.
MITRE provides no official detection text for this object. The guidance above is therefore based on the supplied description, platforms, cited commands, external references, and the DET0341 relationship. Local endpoint capabilities determine whether clipboard API access is visible; absence of an alert should not be treated as proof of absence.
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
For example, on Windows adversaries can access clipboard data by using clip.exe or Get-Clipboard.[1][2][3] Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation).[4]
macOS and Linux also have commands, such as pbpaste, to grab clipboard contents.[5]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
G0087: APT39
APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]
G0094: Kimsuky
Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]
Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]
DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.
G0082: APT38
APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.[1] Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext [2] and Banco de Chile [2]; some of their attacks have been destructive.[1][2][3][4]
North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
G0049: OilRig
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]
S0331: Agent Tesla
Agent Tesla is a spyware Trojan written for the .NET framework that has been observed since at least 2014.[1][2][3]
S0148: RTM
S0692: SILENTTRINITY
SILENTTRINITY is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. SILENTTRINITY was used in a 2019 campaign against Croatian government agencies by unidentified cyber actors.[1][2]
S0334: DarkComet
S0373: Astaroth
S0004: TinyZBot
S0363: Empire
Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]
S0438: Attor
S0332: Remcos
S0257: VERMIN
S1149: CHIMNEYSWEEP
CHIMNEYSWEEP is a backdoor malware that was deployed during HomeLand Justice along with ROADSWEEP ransomware, and has been used to target Farsi and Arabic speakers since at least 2012.[1]
S0356: KONNI
KONNI is a remote access tool that security researchers assess has been used by North Korean cyber actors since at least 2014. KONNI has significant code overlap with the NOKKI malware family, and has been linked to several suspected North Korean campaigns targeting political organizations in Russia, East Asia, Europe and the Middle East; there is some evidence potentially linking KONNI to APT37.[1][2][3][4][5]
C0014: Operation Wocao
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.2 | Current bundle | 369f558e286c… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
MSDN Clipboard
Microsoft. (n.d.). About the Clipboard. Retrieved March 29, 2016.
Open source URL -
[2]
clip_win_server
Microsoft, JasonGerend, et al. (2023, February 3). clip. Retrieved June 21, 2022.
Open source URL -
[3]
CISA_AA21_200B
CISA. (2021, August 20). Alert (AA21-200B) Chinese State-Sponsored Cyber Operations: Observed TTPs. Retrieved June 21, 2022.
Open source URL -
[4]
mining_ruby_reversinglabs
Maljic, T. (2020, April 16). Mining for malicious Ruby gems. Retrieved October 15, 2022.
Open source URL -
[5]
Operating with EmPyre
rvrsh3ll. (2016, May 18). Operating with EmPyre. Retrieved July 12, 2017.
Open source URL -
[6]
mitre-attack T1115Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.