Sysmon Event ID 24 — New content in the clipboard — SecOps Tools

Why event 24 matters

Clipboard stealing (T1115) — attackers harvest credentials, sensitive data, or cryptocurrency wallet addresses from clipboard. Clipboard hijacking — malicious processes replacing clipboard content (e.g., replacing crypto wallet addresses).

How to detect it

Alert: unusual processes accessing clipboard. Alert: Image is suspicious processes (browser extensions, injected processes). Privacy note: clipboard content may contain sensitive data.

Log source

Microsoft-Windows-Sysmon/Operational

Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

Fields to pivot on

ImageCommandLineParentImageUserHashes

MITRE ATT&CK mapping

Tactic	Technique
Collection	Clipboard Data (T1115)

Detection queries

Starting points — adapt the log source, projected fields and thresholds for your environment.

Sentinel / Defender KQL

Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 24   // New content in the clipboard
// EventData holds: Image, CommandLine, ParentImage, User, Hashes
| project TimeGenerated, Computer, RenderedDescription
| sort by TimeGenerated desc

Splunk SPL

index=* sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=24
| stats count earliest(_time) as first_seen latest(_time) as last_seen by ComputerName
| sort - count   `# New content in the clipboard — add EventData fields: Image, CommandLine, ParentImage, User`

Hunt event 24 in Sentinel/Defender →

Build a KQL query for this event in the KQL Query Builder.

Search all event IDs →

Open the interactive Windows Event ID lookup.

Frequently asked questions

What is Sysmon Event ID 24?

New content in the clipboard. Clipboard content changed. Image (process accessing clipboard) and Hashes of clipboard content are key.

Which log records event 24?

Event 24 is written to the Microsoft-Windows-Sysmon/Operational channel by Microsoft-Windows-Sysmon. Requires Sysmon installed with a config that logs this event (e.g. SwiftOnSecurity / Olaf Hartong).

What MITRE ATT&CK techniques map to event 24?

Event 24 is associated with: Clipboard Data (T1115).

How do you detect activity around event 24?

Alert: unusual processes accessing clipboard. Alert: Image is suspicious processes (browser extensions, injected processes). Privacy note: clipboard content may contain sensitive data.