BioShocking: Browser Clipboard Access via Sysmon Process Access Event

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects instances where browser processes (chrome.exe, msedge.exe, brave.exe, firefox.exe) access clipboard-related APIs via Sysmon Event ID 10. This behavior is indicative of potential malicious or unauthorized clipboard interaction, such as sensitive data harvesting or clipboard manipulation by automated agents or scripts.