---
{
  "title": "Clipboard Data",
  "summary": "Clipboard collection captures information users copy between applications.",
  "topic": "soc",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    6
  ],
  "aliases": [
    "T1115"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1115: Clipboard Data",
      "url": "https://attack.mitre.org/techniques/T1115"
    }
  ],
  "editorialVersion": 2
}
---

## Temporary copied information can be sensitive

Clipboard data is information a user copies for transfer between applications. It may include ordinary text, a document fragment, a password, a recovery code, or other sensitive material. Unauthorized clipboard access can collect information that never appears in an obvious saved file.

Clipboard functionality is widely used by legitimate software, including accessibility tools and clipboard managers. The investigation therefore needs to establish which process accessed the information, why that access occurred, and whether the activity fits the user's approved workflow.

## An unfamiliar process watches copying

In a fictional endpoint case, a staff member reports that copied payment details changed when pasted. The responder records the exact observation without asking the user to repeat a real payment. They examine running applications, clipboard-related utilities, extensions, and relevant endpoint activity.

The report could reflect an application formatting feature, user error, or unauthorized interference. Controlled testing with harmless fictional text can help distinguish those possibilities. The team should avoid placing actual credentials or financial details on the clipboard for diagnostic convenience.

Clipboard collection and clipboard modification are different actions. A process that reads copied text may collect information; a process that replaces text changes what the user pastes. Evidence of one does not automatically prove the other.

## Understand the visibility gap

Operating systems and monitoring products differ in how much clipboard activity they expose. A process record may reveal a related utility without showing the clipboard contents. A captured artifact may show some copied data but not every item accessed over time.

State those limitations explicitly. Do not claim that no secrets were exposed simply because a log lacks clipboard content, and do not claim that every secret the user ever copied was captured without evidence of the relevant interval and behavior.

[[data-from-local-system]] describes other collection sources on a host. [[exfiltration]] remains a separate question requiring evidence that collected information crossed the relevant boundary.

## Limit ongoing collection

Restrict the suspicious application or device as justified and investigate how the component was installed or authorized. Review potentially exposed credentials through an appropriate recovery process, considering the evidence and likely scope. Clearing the current clipboard does not remove a program that continues observing future copies.

For practice, compare an approved clipboard manager with an unexplained background process accessing clipboard APIs. Identify the owner, permission, installation, and behavior evidence needed for a decision. Write a cautious exposure statement that distinguishes observed collection from assumptions about retention or transfer. [[incident-reporting]] and [[incident-response]] help keep that distinction visible throughout the case.

## Related concepts

- [[mitre-attack]]
- [[logs-and-telemetry]]
- [[data-manipulation]]