剪贴板数据

Sub-techniques (4)

ID	Name
T1115.001	内存驻留型剪贴板监听
T1115.002	内容特征筛选型数据捕获
T1115.003	伪造进程上下文剪贴板访问
T1115.004	加密隧道化剪贴板数据传输

剪贴板数据窃取是指攻击者通过监控系统剪贴板内容获取敏感信息的技术手段。攻击者利用操作系统提供的剪贴板访问接口（如Windows的clip.exe或macOS的pbpaste），在用户复制粘贴操作过程中窃取凭证、加密密钥等高价值数据。传统防御手段主要通过监控剪贴板访问行为异常（如非用户主动触发的读取操作）或检测可疑进程的API调用模式进行防护。

为规避传统检测机制，攻击者发展出多种剪贴板数据窃取匿迹技术，通过内存驻留、内容过滤、进程伪装及加密隧道等手法，将恶意行为深度融入正常系统操作与网络流量中，形成"低暴露、高精准"的新型数据窃取范式。

当前剪贴板数据窃取匿迹技术的核心在于构建多维度的行为合法性证明与数据流动隐蔽性保障。攻击者通过无文件化内存操作规避磁盘检测，利用智能内容过滤降低数据泄露频次，借助进程上下文伪装破坏行为关联分析，并采用加密隧道技术隐藏数据传输痕迹。四类技术的共性特征体现在：1）深度利用系统合法机制掩盖恶意意图，如通过可信进程加载或协议合规封装实现"白利用"；2）引入智能决策层优化攻击效率，如基于语义分析的精准窃取降低暴露风险；3）构建分层加密体系对抗流量审计，如将数据分片嵌入多协议流量实施隐蔽传输。这些技术突破传统基于单一维度（如API调用监控）的防御体系，要求防御方建立跨内存行为分析、进程行为建模与加密流量解析的综合防护能力。

匿迹技术的演进导致基于规则匹配的静态检测方法失效，防御方需采用用户行为基线分析、内存取证检测、加密流量元数据分析等技术，结合剪贴板访问上下文的多维度关联，构建动态威胁感知体系。同时应强化进程权限管控，限制非必要应用的剪贴板访问权限。

ID: T1115

Sub-techniques: T1115.001, T1115.002, T1115.003, T1115.004

ⓘ

Tactic: 信息收集

ⓘ

Platforms: Linux, Windows, macOS

Version: 1.2

Created: 31 May 2017

Last Modified: 14 April 2023

匿迹效应

效应类型	是否存在
特征伪装	✅
行为透明	✅
数据遮蔽	✅
时空释痕	❌

特征伪装

攻击者通过伪造合法进程的剪贴板访问模式，使恶意行为在API调用序列、内存操作特征等维度与正常应用操作高度相似。例如劫持可信软件的剪贴板处理流程，复用其数字签名与资源访问凭证，实现恶意代码的"合法化"伪装。

行为透明

采用内存驻留与无文件化技术，避免在磁盘或注册表留下可检测痕迹。通过挂钩系统内核级剪贴板管理接口，直接操作内存数据缓冲区，使得传统基于文件监控或进程行为分析的防御机制难以察觉异常。

数据遮蔽

使用前向安全加密算法与协议隧道化技术对窃取数据进行多层加密处理，将原始内容隐藏在HTTPS、DNS等合法协议流量中。加密密钥动态协商机制确保每次传输的加密特征唯一，有效对抗流量内容解密与特征提取。

Procedure Examples

ID	Name	Description
S0331	Agent Tesla	Agent Tesla can steal data from the victim’s clipboard.^[1]^[2]^[3]^[4]
G0082	APT38	APT38 used a Trojan called KEYLIME to collect data from the clipboard.^[5]
G0087	APT39	APT39 has used tools capable of stealing contents of the clipboard.^[6]
S0373	Astaroth	Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries. ^[7]
S0438	Attor	Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.^[8]
S0454	Cadelspy	Cadelspy has the ability to steal data from the clipboard.^[9]
S0261	Catchamas	Catchamas steals data stored in the clipboard.^[10]
S1149	CHIMNEYSWEEP	CHIMNEYSWEEP can capture content from the clipboard.^[11]
S0660	Clambling	Clambling has the ability to capture and store clipboard data.^[12]^[13]
S0050	CosmicDuke	CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.^[14]
S0334	DarkComet	DarkComet can steal data from the clipboard.^[15]
S1111	DarkGate	DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.^[16]
S1066	DarkTortilla	DarkTortilla can download a clipboard information stealer module.^[17]
S0363	Empire	Empire can harvest clipboard data on both Windows and macOS systems.^[18]
S0569	Explosive	Explosive has a function to use the OpenClipboard wrapper.^[19]
S0381	FlawedAmmyy	FlawedAmmyy can collect clipboard data.^[20]
S0531	Grandoreiro	Grandoreiro can capture clipboard data from a compromised host.^[21]
S0170	Helminth	The executable version of Helminth has a module to log clipboard contents.^[22]
S0044	JHUHUGIT	A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.^[23]
S0283	jRAT	jRAT can capture clipboard data.^[24]
S0250	Koadic	Koadic can retrieve the current content of the user clipboard.^[25]
S0356	KONNI	KONNI had a feature to steal data from the clipboard.^[26]
S0409	Machete	Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.^[27]^[28]
S0282	MacSpy	MacSpy can steal clipboard contents.^[29]
S0652	MarkiRAT	MarkiRAT can capture clipboard content.^[30]
S0530	Melcoz	Melcoz can monitor content saved to the clipboard.^[31]
S0455	Metamorfo	Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.^[32]^[33]
S1146	MgBot	MgBot can capture clipboard data.^[34]^[35]
S1122	Mispadu	Mispadu has the ability to capture and replace Bitcoin wallet data in the clipboard on a compromised host.^[36]
C0014	Operation Wocao	During Operation Wocao, threat actors collected clipboard data in plaintext.^[37]
S0332	Remcos	Remcos steals and modifies data from the clipboard.^[38]
S0375	Remexi	Remexi collects text from the clipboard.^[39]
S0240	ROKRAT	ROKRAT can extract clipboard data from a compromised host.^[40]
S0148	RTM	RTM collects data from the clipboard.^[41]^[42]
S0253	RunningRAT	RunningRAT contains code to open and copy data from the clipboard.^[43]
S0692	SILENTTRINITY	SILENTTRINITY can monitor Clipboard text and can use `System.Windows.Forms.Clipboard.GetText()` to collect data from the clipboard.^[44]
S0467	TajMahal	TajMahal has the ability to steal data from the clipboard of an infected host.^[45]
S0004	TinyZBot	TinyZBot contains functionality to collect information from the clipboard.^[46]
S0257	VERMIN	VERMIN collects data stored in the clipboard.^[47]
S0330	Zeus Panda	Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.^[48]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

ID	Data Source	Data Component	Detects
DS0017	Command	Command Execution	Monitor executed commands and arguments to collect data stored in the clipboard from users copying information within or between applications.
DS0009	Process	OS API Execution	Monitor API calls that could collect data stored in the clipboard from users copying information within or between applications.