Reading the Clipboard with pbpaste¶
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
id: | 4e026838-f673-4a5b-b380-615d624fbd00 |
---|---|
categories: | enrich |
confidence: | low |
os: | macos |
created: | 7/26/2019 |
updated: | 7/26/2019 |
MITRE ATT&CK™ Mapping¶
tactics: | Collection |
---|---|
techniques: | T1115 Clipboard Data |
Query¶
process where subtype.create and process_name == "pbpaste"