Reading the Clipboard with pbpaste¶
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
| id: | 4e026838-f673-4a5b-b380-615d624fbd00 |
|---|---|
| categories: | enrich |
| confidence: | low |
| os: | macos |
| created: | 7/26/2019 |
| updated: | 7/26/2019 |
MITRE ATT&CK™ Mapping¶
| tactics: | Collection |
|---|---|
| techniques: | T1115 Clipboard Data |
Query¶
process where subtype.create and process_name == "pbpaste"