PowerShell Get Clipboard

Title: PowerShell Get Clipboard
Status: test
Description:A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.
References:
  -https://github.com/OTRF/detection-hackathon-apt29/issues/16
  -https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
modified:2023-01-04
Tags:

• -'attack.collection'
• -'attack.t1115'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection:
    Payload|contains: 'Get-Clipboard'
  condition:selection
Falsepositives:
  -Unknown
Level: medium