ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Techniques

T1115technique

Clipboard Data

Tactics: collection

Adversaries may collect data stored in the clipboard from users copying information within or between applications. For example, on Windows adversaries can access clipboard data by using <code>clip.exe</code> or <code>Get-Clipboard</code>. Additionally, adversaries may monitor then replace users’ clipboard with their data (e.g., Transmitted Data Manipulation). macOS and Linux also have commands, such as <code>pbpaste</code>, to grab clipboard contents.

MITRE ATT&CK ↗

Linked entities · 24

uses byG0082APT38 uses byG0094Kimsuky uses byG0087APT39 uses byG0049OilRig uses byS1233PAKLOG uses byS0330Zeus Panda uses byS1245InvisibleFerret uses byS1226BOOKWORM uses byS0050CosmicDuke uses byS0409Machete uses byS0381FlawedAmmyy uses byS1122Mispadu uses byS0257VERMIN uses byS0652MarkiRAT uses byS0334DarkComet uses byS1149CHIMNEYSWEEP uses byS1066DarkTortilla uses byS0240ROKRAT uses byS0253RunningRAT uses byS0569Explosive uses byS0660Clambling uses byS1111DarkGate uses byS0455Metamorfo uses byS0356KONNI