Reading the Clipboard with pbpaste

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

id:4e026838-f673-4a5b-b380-615d624fbd00
categories:enrich
confidence:low
os:macos
created:7/26/2019
updated:7/26/2019

MITRE ATT&CK™ Mapping

tactics:Collection
techniques:T1115 Clipboard Data

Query

process where subtype.create and process_name == "pbpaste"

Contributors