Sysmon Event ID 24: ClipboardChange
Sysmon Event ID 24 records new content in the system clipboard.
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-13
Trigger Scenarios
Microsoft documents that this event is generated when system clipboard contents change.
Key Fields
Image / ProcessGuid
The process that changed the clipboard and the join key to Event ID 1.
Session / ClientInfo
Public Sysmon field references expose session and client context, useful for RDP clipboard investigation.
Archived / Hashes
Public Sysmon field references expose whether clipboard content was archived and its hashes; treat archived content as sensitive evidence.
Common False Positives
- Normal user copy/paste activity is common and can include sensitive personal data.
- RDP clipboard redirection and productivity tools can generate expected clipboard changes.
Related Events
- 1 - Process creation
- Event ID 4624Content pending
MITRE ATT&CK Mapping
- T1115Clipboard Data
Detection Notes
Alert selectively when Image is powershell.exe, cmd.exe, wscript.exe, or an unknown binary under C:\Users\ or C:\ProgramData\ and Archived=true or Hashes changes repeatedly in an interactive session. Microsoft documents Event 24 as clipboard-change telemetry, and MITRE T1115 covers adversaries collecting clipboard data with Windows tooling such as Get-Clipboard. Correlate ProcessGuid to Event 1 and Session/ClientInfo to RDP or console logons before handling archived clipboard content.
Sysmon
| where EventID == 24
| project TimeGenerated, Computer, Image, Session, ClientInfo, Hashes, Archived, ProcessGuidindex=sysmon EventCode=24 | table _time, host, Image, Session, ClientInfo, Hashes, Archived, ProcessGuidUtcTime: 2026-07-13 03:04:00.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Session: 2
ClientInfo: RDP
Archived: true
Hashes: SHA256=REDACTED
ProcessGuid: {REDACTED}