Skip to content

Clipboard Data

Technique · ATTACK:enterprise:T1115

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1115",
  "title": "Clipboard Data",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1115",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--30973a08-aed9-4edf-8604-9084ce1b5c4f",
  "external_id": "T1115",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:25.967Z",
  "modified": "2026-05-12T15:12:00.624Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "CISA_AA21_200B",
      "url": "https://www.cisa.gov/uscert/ncas/alerts/aa21-200b"
    },
    {
      "source_name": "mining_ruby_reversinglabs",
      "url": "https://blog.reversinglabs.com/blog/mining-for-malicious-ruby-gems"
    },
    {
      "source_name": "clip_win_server",
      "url": "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/clip"
    },
    {
      "source_name": "MSDN Clipboard",
      "url": "https://msdn.microsoft.com/en-us/library/ms649012"
    },
    {
      "source_name": "Operating with EmPyre",
      "url": "https://medium.com/rvrsh3ll/operating-with-empyre-ea764eda3363"
    }
  ]
}

Explicit source assertions (46)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0331 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--06dded4b-f28c-45d3-8dc6-097a9a4a3cd6

Talos Agent Tesla Oct 2018 · Fortinet Agent Tesla April 2018 · Fortinet Agent Tesla June 2017 · Bitdefender Agent Tesla April 2020

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f81e969-dfc4-4d37-8664-59c31bd7116c

Symantec Chafer February 2018

ATTACK:enterprise:S0148 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1e03e95c-1c9a-4fa8-9d6d-b5d244b06509

ESET RTM Feb 2017 · Unit42 Redaman January 2019

ATTACK:enterprise:S0692 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1ff3e957-905e-4d2b-b893-c280052bbe30

Github_SILENTTRINITY

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--268e43b1-56fb-42ff-8b2b-d7fb06d11f65

Aryaka Kimsuky July 2025

ATTACK:enterprise:S0334 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--28b56048-87a7-4204-b55b-3f2f79f9073f

Malwarebytes DarkComet March 2018

ATTACK:enterprise:S0373 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29bf3ce1-f531-472f-9825-b990aab2f09c

Cybereason Astaroth Feb 2019

ATTACK:enterprise:S0004 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35ca6c35-f1e9-49b7-a8c9-a67951c57ea0

Cylance Cleaver

ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ca37791-9dad-430f-aee9-0126d13ae932

Github PowerShell Empire

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40205b23-d3d0-4d6a-a739-7ba2eb061c4f

ESET Attor Oct 2019

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--441ef1f7-79b7-476a-8c1e-943439e65dd1

Riskiq Remcos Jan 2018 · Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S0257 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5070c502-1f3b-4e8c-8eb5-2ea5379fd8f4

Unit 42 VERMIN Jan 2018

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5093ddae-6bc9-401e-b35f-9f3139efafd0

FoxIT Wocao December 2019

ATTACK:enterprise:S1149 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--551f1eb5-0cb9-4f5b-a97d-c61c081eea9e

Mandiant ROADSWEEP August 2022

ATTACK:enterprise:S0356 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--592df85b-8f0b-46c1-87e6-fa48da9c0ead

Talos Konni May 2017

ATTACK:enterprise:S0375 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5940076b-120a-4588-b227-7fe2bc9f7ccd

Securelist Remexi Jan 2019

ATTACK:enterprise:S0282 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a2b7013-a110-4a07-acf6-66a7f159954d

objsee mac malware 2017

ATTACK:enterprise:S0454 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c859db1-13ba-4bf8-a8d3-7fd99e061c45

Symantec Chafer Dec 2015

ATTACK:enterprise:S1233 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--601ae14e-841f-4c18-bbe5-b570cb7d8d26

Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025

ATTACK:enterprise:S0250 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66440b92-cfed-441c-85fd-1d103684a187

ATTACK:enterprise:S0050 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66625422-17cd-4b04-beb5-fa2eabe350ad

F-Secure Cosmicduke

ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ce17afb-98fb-4b43-b99d-2eaa3c88a25e

Netskope XLoader 2022 · Google XLoader 2017

ATTACK:enterprise:S0660 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--744da30b-d540-4512-85c7-d32310e2aa78

Trend Micro DRBControl February 2020 · Talent-Jump Clambling February 2020

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--778aa9ba-0561-44bd-a28f-94ba2b12f78b

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:S0455 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--787f09c0-92fe-4208-96e8-86c8e45c9a40

Fortinet Metamorfo Feb 2020 · ESET Casbaneiro Oct 2019

ATTACK:enterprise:S0409 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e05e716-1a86-4f87-9eba-5b5c6ee61b8a

ESET Machete July 2019 · Securelist Machete Aug 2014

ATTACK:enterprise:S0044 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83aac36d-6dfa-4c27-b1b1-c200c9240eb9

Unit 42 Playbook Dec 2017

ATTACK:enterprise:S0240 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83f5442e-74c1-4e7b-83d8-9c254543bbac

Volexity InkySquid RokRAT August 2021

ATTACK:enterprise:S1146 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85ec27f0-77c3-4896-9934-cac7b73c87e9

ESET EvasivePanda 2023 · Symantec Daggerfly 2023

ATTACK:enterprise:S0531 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e1742a1-ffc0-4e29-88d2-04ef30a13358

IBM Grandoreiro April 2020

ATTACK:enterprise:S0170 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a58983e1-45d7-4b45-a578-307659a619dc

Palo Alto OilRig May 2016

ATTACK:enterprise:S0261 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a804782a-fc22-43ab-a561-63007284bdf9

Symantec Catchamas April 2018

ATTACK:enterprise:S0283 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ac3fb8d5-9d9d-4701-a269-53e838850d71

Kaspersky Adwind Feb 2016

ATTACK:enterprise:S0569 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2553142-9377-42b3-9fd6-50fcbd4263b3

CheckPoint Volatile Cedar March 2015

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b2a83e1d-f6e8-4cdc-a96e-7bca9a48dfb2

FireEye APT38 Oct 2018

ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baefb35b-634a-42d4-9cec-7cf1f5e1b324

Ensilo Darkgate 2018 · Rapid7 BlackBasta 2024

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c3221e04-0e40-4454-acf0-46b1e450c0a0

Symantec Crambus OCT 2023

ATTACK:enterprise:S0330 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce378e64-5802-4751-8b8e-d7bf68ce4c6a

GDATA Zeus Panda June 2017

ATTACK:enterprise:S0530 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce8220fc-98ee-4b48-b98c-8be15a429410

Securelist Brazilian Banking Malware July 2020

ATTACK:enterprise:S0253 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4f4974e-7918-4829-8379-5e2e98f2ae20

McAfee Gold Dragon

ATTACK:enterprise:S1122 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9ce0226-58f6-4907-a20f-6c821b537f7f

ESET Security Mispadu Facebook Ads 2019

ATTACK:enterprise:S0381 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2335bc2-8ad0-484d-89b5-70b05a131296

Korean FSI TA505 2020

ATTACK:enterprise:S1245 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e40276e4-dc1f-4ae9-a172-d5fae0d674e7

Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024 · ESET Contagious Interview BeaverTail InvisibleFerret February 2025 · Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024 · PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023

ATTACK:enterprise:S0652 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e94dc1ba-678b-4c09-9c29-515a5d277ec4

Kaspersky Ferocious Kitten Jun 2021

ATTACK:enterprise:S0467 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f283af63-1fdf-49d3-8a56-304c5be07a83

Kaspersky TajMahal April 2019

ATTACK:enterprise:S1226 → uses → ATTACK:enterprise:T1115

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f43a1b3a-432b-47e7-8da6-4bac45d1ae4e

Unit42 Bookworm Nov2015

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.