WaterPlum-style clipboard hijack with secondary suspicious signal

Arnold Chan@slaz

•updated 20 days ago•0•0•0

This rule detects suspicious clipboard access attempts initiated by common scripting interpreters (node.exe, python.exe, powershell.exe) in non-standard paths or correlated with recent external network connections. It is designed to identify potential credential theft or data staging using clipboard interaction methods often employed by malware.