Sysmon Event ID 24

SourceSysmon

24: ClipboardChange

This is an event from Sysmon.

On this page

This event logs whenever new content is copied into the clipboard and archives said content to the same protected archive folder as deleted files with Event ID 23. This is event is probably intended as way to collect additional evidence during an investigation of an ongoing incident.

Free Security Log Resources by Randy

Description Fields in 24

  • Log Name
  • Source
  • Date
  • Event ID
  • Task Category
  • Level
  • Keywords
  • User
  • Computer
  • Description
  • RuleName
  • UtcTime
  • ProcessGuid
  • ProcessId
  • Image
  • Session
  • ClientInfo
  • Hashes
  • Archived

Setup PowerShell Audit Log Forwarding in 4 Minutes

 

Examples of 24

Log Name:       Microsoft-Windows-Sysmon/Operational
Source:         Microsoft-Windows-Sysmon
Date:           4/15/2021  8:57:35 PM
Event ID:       24
Task Category: Clipboard changed (rule: ClipboardChange)
Level:          Information
Keywords:      
User:           SYSTEM
Computer:       w19-ex-111.Win2019.local
Description: Clipboard changed:
RuleName: -
UtcTime: 2021-04-16 03:57:35.123
ProcessGuid: {ff9115ad-7ba0-6078-bf00-000000002c00}
ProcessId: 4832
Image: C:\Windows\System32\rdpclip.exe
Session: 2
Client Info: user: WIN2019\admin hostname: EndPoint342
Hashes: SHA1=9EB203E8CD0DA806D91D6C2EB9669C28E29D5330,MD5=234A0C813539AB6B2CCAE02EAD314381,SHA256=48ED6A8C89DB330140D82BA0FE8F1D901645A0E18262172E6CDACE57C18B9720,IMPHASH=00000000000000000000000000000000
IsExecutable: false
Archived: true

Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Sysmon" Guid="{5770385F-C22A-43E0-BF4C-06F5698FFBD9}" />
    <EventID>24</EventID>
    <Version>5</Version>
    <Level>4</Level>
    <Task>24</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2021-04-16T03:57:35.124166400Z" />
    <EventRecordID>13339</EventRecordID>
    <Correlation />
    <Execution ProcessID="3500" ThreadID="3824" />
    <Channel>Microsoft-Windows-Sysmon/Operational</Channel>
    <Computer>w19-ex-111.Win2019.local</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="RuleName">-</Data>
    <Data Name="UtcTime">2021-04-16 03:57:35.123</Data>
    <Data Name="ProcessGuid">{ff9115ad-7aff-6078-4000-000000002c00}</Data>
    <Data Name="ProcessId">4832</Data>
    <Data Name="User"> NT AUTHORITY\SYSTEM</Data>
    <Data Name="Image">C:\Windows\System32\rdpclip.exe</Data>
    <Data Name="Session">2</Data>
    <Data Name="ClientInfo">user: WIN2019\admin hostname: EndPoint342</Data>
    <Data Name="Hashes">SHA1=9EB203E8CD0DA806D91D6C2EB9669C28E29D5330,MD5=234A0C813539AB6B2CCAE02EAD314381,SHA256=48ED6A8C89DB330140D82BA0FE8F1D901645A0E18262172E6CDACE57C18B9720,IMPHASH=00000000000000000000000000000000      <Data Name="IsExecutable">false</Data>
    <Data Name="Archived">true</Data>
</Data>   </EventData>
</Event>

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources