Clipboard Data Theft via PowerShell, VBScript, or Win32 API

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

This rule detects processes attempting to access or manipulate Windows clipboard data, often used by adversaries to steal sensitive information copied by users. It monitors common living-off-the-land tools like PowerShell, WScript, CScript, and MSHTA executing clipboard-related functions or interacting with clip.exe.