Microsoft Sysmon Now Logs Data Copied to the Windows Clipboard

Microsoft has released Sysmon 12, and it comes with a useful feature that logs and captures any data added to the Windows Clipboard.

This feature can help system administrators and incident responders track the activities of malicious actors who compromised a system.

Those not familiar with Sysmon, otherwise known as System Monitor, it is a Sysinternals tool that monitors Windows systems for malicious activity and logs it to the Windows event log.

Sysmon 12 Adds Clipboard Capturing

With the release of Sysmon 12, users can now configure the utility to generate an event every time data is copied to the Clipboard. The Clipboard data is also saved to files that are only accessible to an administrator for later examination.

As most attackers will utilize the Clipboard when copying and pasting long commands, monitoring the data stored in the Clipboard can provide useful insight into how an attack was conducted.

To get started, download Sysmon 12 from its dedicated Sysinternal’s page or https://live.sysinternals.com/sysmon.exe.

Once downloaded, run it from an elevated command prompt, as it needs administrative privileges to run.

Simply running Sysmon.exe without any arguments will display a help screen, and for more detailed information, you can go to the Sysinternals’ Sysmon page.

Also Read: By Attending This Event You Agree To Be Photographed

Without any configuration, Sysmon will monitor basic events such as process creation and file time changes.

It is possible to configure it to log many other types of information by creating a Sysmon configuration file, which we will do to enable the new ‘CaptureClipboard’ directive.

For a very basic setup that will enable Clipboard logging and capturing, you can use the configuration file below:

To start Sysmon and direct it to use the above configuration file, you would enter the following command from an elevated command prompt:

sysmon -i sysmon.cfg.xml

Once started, Sysmon will install its driver and begin collecting data quietly in the background.

Also Read: What is Pentest Report? Here’s A Walk-through

All Sysmon events will be logged to ‘Applications and Services Logs/Microsoft/Windows/Sysmon/Operational‘ in the Event Viewer.

With the CaptureClipboard feature enabled, when data is copied into the Clipboard it will generate an ‘Event 24 – Clipboard Changed’ entry in Event Viewer, as shown below.

The event log entry will display what process stored the data in the clipboard, the user who copied it, and when it was done. It will not, though, show the actual data that was copied.

The copied data is instead saved to the protected C:\Sysmon C:\Sysmon folder in files named clip-SHA1_HASH, where the hash is provided in the event above.

For example, the event displayed above would have the Clipboard contents stored in the C:\Sysmon\CLIP-CC849193D18FF95761CD8A702B66857F329BE85B file.

This C:\Sysmon folder is protected with a System ACL, and to access it, you need to download the psexec.exe program and launch a cmd prompt with System privileges using the following command:

psexec -sid cmd

After the new System command prompt is launched, you can go into the C:\Sysmon folder to access the saved Clipboard data.

When opening the CLIP-CC849193D18FF95761CD8A702B66857F329BE85B file, you can see that it contains a PowerShell command that I copied into the clipboard from Notepad.exe.

This PowerShell command is used to clear Shadow Volume Copies in Windows, which can be used by an attacker who wants to make it harder to restore deleted data.

Having this information illustrates how useful this feature can be when performing incident response.

Another useful feature added in Sysmon 11 will automatically create backups of deleted files, allowing administrators to recover files used in an attack.

Learn More About Sysmon

For those who want to learn more about Sysmon, it is strongly recommended that you read the documentation on Sysinternals’ site and to play around with the tool.

There is no better way to learn how to use this program then by creating configuration files and see what events are written to the event log.

More information about the various directives used in Sysmon can be obtained by entering the sysmon.exe -s all command.

If you want to use a premade Sysmon config file designed to monitor malicious traffic and threats, you can use SwiftOnSecurity’s Sysmon configuration file on GitHub.