Hello and welcome to
another application of the moderate
tech framework and discussion,
so today we are looking
at clipboard data and now
right out the gate doesn't seem very
interesting. All right.
But I do have a little surprise
for you that I thought was kind of
neat.
And so we'll go through that
together today as well.
So we're really going to look at
what clipboard data is with respect
to the MIETEK framework.
We've got a little example that
we're going to tag in to here and
talk about mitigation techniques
and the detection techniques
as well.
Now, as far as Meitner is concerned,
clipboard data is when a threat
actor will attempt to collect data
stored in Windows clipboard.
It can also be on Max.
It could be really anything that has
a clipboard.
Now, with Windows, the application
can access clipboard data by using
the Windows API.
OSX provides a Native Command
PBH paste to grab clipboard
content.
Now you're probably thinking
really what could possibly
be useful here?
And so I thought the same thing.
I was like, really?
What is the application of this and
what can we do with it?
So I went on a little adventure
and I took some time to
play around with
a few things to try and figure
out. The scenario here was getting
the secret to the perfect
cheesecakes and my grandmother uses
my computer. This is all fictitious
and she is trying to
essentially fine tune
her recipe. And I'm curious because
she doesn't tell me what she's
doing.
And so I figured I would make
something that could help me take
clipboard information from my
computer when she's using it.
Now, there are some things here that
won't line up with respect to
getting to this point, because you
would actually have to interact with
something. But let's go from the
top. So I created a
power shell script
and that script will
essentially change the directory
to my downloads and it will
run the following command, get
clipboard and output it to a
clipboard, that text document,
and then it will exit and leave.
Now, for those of you that know how
Power Shell works, I can't just
create a script
and run it.
You can't double click this and it
runs. You have to have something
else, a mechanism that
makes it run.
And so in that case, we
created a shortcut to
open power shell and then execute
the script by feeding it into power
shell. Now, the cool thing here
is that my antivirus
actually said, hey, you've got
something that's not behaving
correctly. It's kind of being sneaky
and it opted to quarantine
that power shell script.
So I thought that was kind of cool
because that means that, one,
my system, even with free antivirus,
is doing what it should do to try
and protect me from things that I
shouldn't be messing with.
But the good news is, is that
this even though there are not
always mitigating factors that block
these types of things, we do
have even at the free level,
antivirus products that seem to be
able to to detect this stuff and
block it, which makes me feel good.
But I want to hit and disable this
whitelist of this particular script
in this case so that I could
try to get this secret.
Now, the way a threat actor might
use this is they might take this
shortcut and turn it into something
that seems beneficial or enticing
to the user.
Could be that I named it something
like secret cheesecake, recipes
or whatever the case may be.
And I placed it out there somewhere
and someone clicked on it after
maybe doing some Web surfing or
whatever the case may be.
And when it outputs, you'll see
here that I actually got it to
output the clipboard information
concerning the last thing
that was copied and pasted while
the user was logged in.
Now, there are some potential other
use cases for this, like putting it
in a running task.
Any time an individual
goes to open Internet Explorer, when
a certain process runs, you
could really do some custom
activities or custom behaviors that
would cause this to fire off.
But this is just a high level
use case for what could happen
here with the clipboard
functions in our system.
And again, chances
are, if it behaves in the same
manner that my script was behaving,
then it is likely that a good
antivirus will block the behavior
and deem it suspicious.
So I thought that was cool.
I hope you enjoyed that as much
as I enjoyed putting it together.
Now, mitigation techniques,
we do indicate here in user
awareness training because.
Perminder this is a tough activity
to identify.
The good news is, is that antivirus
and things of that nature that has a
decent behavior analysis or behavior
kind of flagging component
will likely catch some of these
activities.
But more sophisticated threat actors
may have some techniques that make
this run. A little less
forcefully, a little less
mom wasn't exactly what I would call
graceful, because we cannot do it
together, for example, sake but
sophisticated to actors would likely
write very complex
and sophisticated scripts
and code to maybe circumvent
some of those areas.
But in user awareness training, we
can never go wrong with that.
Now, from a detection standpoint,
you're going to need to look for
suspicious behavior patterns
that indicate a third actor may be
on the network or system.
So what this is getting back to is,
is that you're going to be looking
at broader data sets in order to
tie activities into what
would be a throwback or either
moving laterally, trying to run
scripts, trying to gather
information.
And so those are really going to be
your primary detection techniques.
And so, again, as we get into some
of these other areas of the
attack framework in some of these
vectors, it's really coming
down to a dependency more and
more on human intervention
and human analysis.
Whereas in some of the earlier
phases, we may be able to get away
with using some automated methods to
provide detection services and
mitigation services.
Now let's do
a check on
learning. True or false
clipboard data is the data that a
user copies likely with the
intent to move it to another
location or application?
Right. If you need additional time,
please take a moment.
In this instance, this is
a true statement.
Clipboard data is when a user copies
information with the intent to move
it to another location or
application to generally paste
it in. So that is true.
So in summary of today's discussion,
we described clipboard data.
We looked at a high level example
wedged in here on how to use
scripting to pull clipboard
information, potentially.
We talked mitigation techniques and
we talked detection techniques.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.