HomesecurityMicrosoft Sysmon: Captures data copied to the Windows Clipboard

Microsoft Sysmon: Captures data copied to the Windows Clipboard

Microsoft has released Sysmon 12 and comes with a useful feature that records any data added to the Windows Clipboard.

This feature can help system administrators and incident responders monitor the activities of malicious agents that could compromise a system.

For those unfamiliar with Sysmon, otherwise known as System Monitor, it is a Sysinternals tool that monitors Windows systems for malicious activity and does register in the Windows event file.

Sysmon Clipboard Windows

With the release of Sysmon 12, users can now configure the utility to create an event each time data is copied to the Clipboard. Clipboard data is also stored in files that are only accessible to administrators for future reference.

As most intruders use Clipboard when copying and pasting Long Commands, monitoring the data stored on the Clipboard can provide useful information on how to carry out an attack.

To use the feature, download Sysmon 12 from its dedicated page Sysinternal ή

Once downloaded, run it from an elevated command prompt, as it needs administrator privileges to run.

Simple run of Sysmon.exe will display a "help screen" and for more detailed information, you can go to its page sysmon.

Without any configuration, Sysmon will keep track of key events, such as process creation and current time changes archives.

If we configure it, it can record many other types of events, creating a Sysmon configuration file, which we will do to activate the new "CaptureClipboard" instruction.

For a very basic regulation that allows you to connect and record the Clipboard, you can use the configuration file you see below:


To start Sysmon and direct it to use the above configuration file, you will need to enter the following command from a command line with upgraded rights:


Once started, Sysmon will install it driver and will start collecting data silently in the background.

All Sysmon events will be recorded in “Applications and Services Logs / Microsoft / Windows / Sysmon / Operational”In the Event Viewer.

With the CaptureClipboard feature enabled, when data is copied to the Clipboard, an "Event 24 - Clipboard Changed" entry will be created in the Event Viewer, as you can see below.

Microsoft Windows

The event log will show what process the data was stored on the clipboard, the user who copied it and when it was done. However, it will not show the actual data that was copied.

The copied data is stored in the protected folder C: \ Sysmon C: \ Sysmon in files whose names are of type clip-SHA1_HASH, where the hash is provided in the above event.

For example, the event shown above will have the contents of the Clipboard saved in the file C:\Sysmon\CLIP-CC849193D18FF95761CD8A702B66857F329BE85B.

This C: \ Sysmon folder is protected with ACL system and to access it, you need to download the psexec.exe program and start a cmd query with system permissions using the following command:

After starting the new system command prompt, you can go to the C: \ Sysmon folder to access the saved draft data.

Microsoft Clipboard

When you open the CLIP-CC849193D18FF95761CD8A702B66857F329BE85B file, you can see that it contains a PowerShell command that is copied to Notepad.

Microsoft Clipboard

This PowerShell command is used to clear Shadow Volume Copies in Windows, which can be used by an attacker who wants to make it harder to recover deleted files. data.

The existence of this information shows how useful this function can be when performing an "incident response".

Another useful feature added to Microsoft Sysmon 11 will automatically back up deleted files, allowing administrators to recover files used in an attack.


Teo Ehc
Be the limited edition.