Clipper
Swaps copied cryptocurrency addresses in the clipboard for attacker-controlled ones
categoryMalwareseverityLowdetectability (measured in our lab)Mediumlabdetected in lab
Example: Metamorfo
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1115 -Tool atomic -RunId run-2026-10-20-008 -Command 'Invoke-AtomicTest T1115 -TestGuids d6dc21af-bec9-4152-be86-326b6babd416 -TimeoutSeconds 120'powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1115 -Tool atomic -RunId run-2026-10-30-007 -Command 'Invoke-AtomicTest T1115 -TestGuids d6dc21af-bec9-4152-be86-326b6babd416 -TimeoutSeconds 120'What our lab measured
detected windows · 2026-10-30 · detected in 39s
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | Clipboard contents read from a PowerShell script (Get-Clipboard / Clipboard::GetText), possibly piped to iex -- T1115 |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| PowerShell · EID 4104 | Powershell executing process discovery |
| PowerShell · EID 4104 | Powershell script querying system environment variables |
| PowerShell · EID 4104 | Powershell script recursively collected files from a filesystem search |
| PowerShell · EID 4104 | Powershell script searching filesystem |
| PowerShell · EID 4104 | Powershell script used "Invoke-command" cmdlet to execute sub script |
| Security · EID 4624 | Non network or service local logon. |
| … and 5 more event type(s) | |
Detection that fired
- ✓ Wazuh
100444(level 6) lab rule — Clipboard contents read from a PowerShell script (Get-Clipboard / Clipboard::GetText), possibly piped to iex -- T1115 - ✓ Wazuh
100445(level 6) lab rule — Clipboard contents read from a PowerShell script (Get-Clipboard / Clipboard::GetText), possibly piped to iex (Security 4688 arm) -- T1115
Plus 11 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~5309 incidental alerts/hour — tune against this.
partially detected windows · 2026-10-20
What it looked like in telemetry
| Log source | What it means |
|---|---|
| Sysmon · EID 1 | Powershell process spawned powershell instance |
| Sysmon · EID 11 | Executable file dropped in folder commonly used by malware |
| PowerShell · EID 4104 | Powershell executing process discovery |
| PowerShell · EID 4104 | Powershell script querying system environment variables |
| PowerShell · EID 4104 | Powershell script recursively collected files from a filesystem search |
| PowerShell · EID 4104 | Powershell script searching filesystem |
| PowerShell · EID 4104 | Powershell script used "Invoke-command" cmdlet to execute sub script |
| Security · EID 4624 | Non network or service local logon. |
| … and 4 more event type(s) | |
Plus 12 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~63038 incidental alerts/hour — tune against this.
Classification
24 values: 10 reviewed, 2 lab-measured, 7 imported, 5 derived. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Passive |
| Attacker skill required | High |
| Resources required | Low |
| Likelihood / prevalence | Low |
| Maturity | Commoditized |
Impact & scope
| Severity | Low |
|---|---|
| Impact | Confidentiality |
| Platform | LinuxmacOSWindows |
| Environment | MobileOn-premises |
| Target asset class | EndpointIdentity |
| Kill-chain phase (tactic) | Collection |
Detection & telemetry
| Detectability (measured in our lab) | Medium |
|---|---|
| Detectability (public detection content) | High |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Process AccessProcess Creation |
Detection & response
Detected by 11
- DET0341 attack-detection-strategy
214e7e6c-f21b-47ff-bb6f-551b2d143fcfsigma4cbd4f12-2e22-43e3-882f-bff3247ffb78sigma7794fa3c-edea-4cff-bec7-267dd4770fd7sigmab9aeac14-2ffd-4ad3-b967-1354a4e628c3sigmad8af0da1-2959-40f9-a3e4-37a6aa1228b7sigmaddeff553-5233-4ae9-bbab-d64d2bd634besigmaec127035-a636-4b9a-8555-0efd4e59f316sigmaf200dc3f-b219-425d-a17e-c38467364816sigma100444wazuh100445wazuh
Tested by 5
0cd14633-58d4-4422-9ede-daa2c9474ae7atomic1ac2247f-65f8-4051-b51f-b0ccdfaaa5ffatomic9c8d5a72-9c98-48d3-b9bf-da2cc43bdf52atomicd6dc21af-bec9-4152-be86-326b6babd416atomicee363e53-b083-4230-aff3-f8d955f2d5bbatomic
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-20-008 | partially-detected | atomic | windows | 2026-10-20 |
run-2026-10-30-007 | detected | atomic | windows | 2026-10-30 |
run-2026-10-20-008— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=5). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1115 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=1646 max_level=15 dwell_s=90run-2026-10-30-007— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=5). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1115 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=146 max_level=15 dwell_s=90
Framework references
- Primary source: https://attack.mitre.org/techniques/T1115/
- attack: T1115 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 108 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 46 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-008 (partially-detected) for T1115: no alert matched the expected technique
- ev-0004 (Phase 4 detection lab - detonation runs 2026-10-30) — Lab detonation run-2026-10-30-007 (detected): Wazuh rule(s) 100444, 100445 fired on T1115 within the detonation window
Clipboard contents read from a PowerShell script (Get-Clipboard / Clipboard::GetText), possibly piped to iex -- T1115