Sysmon Event ID 24: ClipboardChange
- Applicable version
- Sysmon with this event enabled
- Last reviewed
- 2026-07-22
Quick summary
Sysmon Event ID 24 records new content in the system clipboard.
Technical Metadata
| Event ID | 24 |
|---|---|
| Provider | Microsoft-Windows-Sysmon |
| Channel | Microsoft-Windows-Sysmon/Operational |
| Level | Informational |
| MITRE ATT&CK | TA0009 Collection / T1115 Clipboard Data |
| Key fields to watch | Image / ProcessGuid, Session / ClientInfo, Archived / Hashes |
Trigger Scenarios
Microsoft documents that this event is generated when system clipboard contents change.
Key Fields
Image / ProcessGuid
The process that changed the clipboard and the join key to Event ID 1.
Session / ClientInfo
Public Sysmon field references expose session and client context, useful for RDP clipboard investigation.
Archived / Hashes
Public Sysmon field references expose whether clipboard content was archived and its hashes; treat archived content as sensitive evidence.
Threat Hunting Queries
Event
| where EventLog == "Microsoft-Windows-Sysmon/Operational" and EventID == 24
| project TimeGenerated, Computer, EventID, RenderedDescription
| order by TimeGenerated desc- Data source
- Microsoft Sentinel Event table
- Assumptions
- The Sysmon Operational channel is collected into Event. Map raw XML fields to the event-specific fields described on this page.
index=sysmon source="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=24
| table _time, host, EventCode, Message- Data source
- Splunk Sysmon event data
- Assumptions
- Index, source, and parsed field names vary by deployment. Apply the documented field conditions after validating local field extraction.
dataset = microsoft_windows_raw
| filter edr_event_id = 24- Data source
- Cortex XDR microsoft_windows_raw
- Assumptions
- Confirm Provider is Microsoft-Windows-Sysmon because event IDs are not globally unique. Inspect raw provider fields because parsed names vary by collection path.
title: Sysmon Event ID 24
status: experimental
logsource:
product: windows
service: sysmon
detection:
selection:
EventID: 24
condition: selection
falsepositives:
- Legitimate administrative or system activity
level: informational- Data source
- Sigma Windows Sysmon log source
- Assumptions
- This rule retrieves the event and is not a standalone malicious-behavior detection. Add the event-specific conditions and correlations documented on this page.
Documented Values and Codes
| Field | Value | Meaning | Security relevance |
|---|---|---|---|
| EventID | 24 | The system clipboard content changed. | Interpret EventID with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
| ProcessGuid | GUID | Stable process identifier for joining clipboard activity to Event 1. | Interpret ProcessGuid with the other documented fields and correlated events; this value alone is not proof of compromise. Source |
MITRE ATT&CK Mapping
- T1115Clipboard Data
Detection Notes
Alert selectively when Image is powershell.exe, cmd.exe, wscript.exe, or an unknown binary under C:\Users\ or C:\ProgramData\ and Archived=true or Hashes changes repeatedly in an interactive session. Microsoft documents Event 24 as clipboard-change telemetry, and MITRE T1115 covers adversaries collecting clipboard data with Windows tooling such as Get-Clipboard. Correlate ProcessGuid to Event 1 and Session/ClientInfo to RDP or console logons before handling archived clipboard content.
Common False Positives
- Normal user copy/paste activity is common and can include sensitive personal data.
- RDP clipboard redirection and productivity tools can generate expected clipboard changes.
Related Events
- 1 - Process creation
- Event ID 4624Content pending
Sample Log
UtcTime: 2026-07-13 03:04:00.000
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Session: 2
ClientInfo: RDP
Archived: true
Hashes: SHA256=REDACTED
ProcessGuid: {REDACTED}Frequently Asked Questions
What does Sysmon Event ID 24 mean?
The system clipboard content changed.
Does Event ID 24 always indicate malicious activity?
No. Clipboard changes are routine interactive behavior.
How should Event ID 24 be investigated?
Scope collection carefully and correlate Image and ProcessGuid with the user session and suspicious process behavior.
Sources
- 24: ClipboardChange
Microsoft Sysinternals · vendor
- Clipboard Data (T1115)
MITRE ATT&CK · attack
- XDR Collector datasets
Palo Alto Networks · vendor
- Sigma Rules Specification
SigmaHQ · detection rule