A Windows system tray application that provides real-time protection against malicious PowerShell commands copied from web browsers to the clipboard.
Clipboard Security Monitor continuously monitors your clipboard for potentially dangerous PowerShell code originating from browser applications. When malicious content is detected, it automatically blocks and redacts the content, replacing it with a security warning to protect users from clipboard-based attacks.
• Real-time Clipboard Monitoring - Continuously monitors clipboard changes (every 100ms) • Browser Source Detection - Identifies content originating from Chrome, Edge, Firefox, Opera, Safari, and other browsers • Advanced Threat Detection - Scans for 40+ risky PowerShell patterns including:
- Invoke-Expression and encoded commands
- Download-and-execute patterns
- Execution policy bypasses
- Hidden window execution
- System modification commands • Automatic Content Redaction - Replaces malicious content with detailed security warnings • Comprehensive Logging - Records all security events to Windows Event Log and activity log files • System Tray Integration - Minimalist interface with status indicators • Always-On Protection - Continuous security without user intervention required
- Windows 10 or Windows 11 (64-bit)
- .NET 8.0 Runtime (included in self-contained distribution)
- Administrator privileges (required for first run only)
- Download the ClipboardSecurityMonitor.exe file
- Right-click and select "Run as administrator" (first time only)
- The application will start in your system tray with a green shield icon
- Download: Obtain ClipboardSecurityMonitor.exe from the distribution package
- Initial Setup: Run as administrator to create Windows Event Log source
- Verification: Look for green shield icon in system tray indicating active protection
- Auto-Start: Add to Windows Startup folder for automatic protection on boot
- Green Shield Icon: Protection is active and monitoring clipboard
- Right-click Menu: Access status, activity log, and application information
- Double-click: Display current protection status
- Status: View monitoring statistics and configuration details
- About: Application information and feature overview
- View Activity Log: Comprehensive log viewer with export functionality
- Exit: Stop monitoring and close application (requires confirmation)
When malicious PowerShell content is detected from a browser:
- Detection: Threat patterns are identified and risk level assessed
- Blocking: Original malicious content is completely removed from clipboard
- Replacement: Clipboard is populated with detailed security warning
- Logging: Security event is recorded in Windows Event Log and activity log
- Notification: System tray balloon notification alerts user
The application logs security events to Windows Event Viewer under:
- Log: Application Event Log
- Source: ClipboardSecurityMonitor
- Event IDs:
- 1000: Application startup/initialization
- 1001: Malicious content detected (Warning level)
- 1002: Malicious content blocked and redacted (Error level)
- Application: ClipboardSecurityMonitor.exe
- Activity Log: clipboard_monitor.log (same directory as executable)
- Windows Event Log: Windows Event Viewer → Windows Logs → Application
The application detects various PowerShell attack patterns including:
Command Execution:
- Invoke-Expression, iex
- Encoded commands (-EncodedCommand)
- Download-and-execute patterns
Security Bypasses:
- Execution policy bypass (-ExecutionPolicy Bypass)
- Hidden window execution (-WindowStyle Hidden)
- Process elevation (Start-Process -Verb RunAs)
System Modification:
- Registry manipulation (Set-ItemProperty, New-ItemProperty)
- Service management (New-Service, Set-Service)
- Firewall rule changes (New-NetFirewallRule)
- Scheduled task creation (New-ScheduledTask)
Obfuscation Techniques:
- Character encoding ([char], [convert])
- Variable concatenation patterns
- Base64 encoding (FromBase64String)
The application operates in "always-on" mode with the following default settings:
- Monitoring: Continuous clipboard monitoring (cannot be disabled)
- Protection: Automatic threat blocking (cannot be disabled)
- Logging: All security events logged to multiple destinations
- Detection: Browser-sourced threats only (non-browser content is ignored)
Application doesn't start:
- Ensure .NET 8.0 is installed (or use self-contained distribution)
- Run as administrator for first-time setup
- Check Windows Event Log for error messages
No system tray icon visible:
- Check Windows notification area settings
- Ensure "Show hidden icons" is enabled
- Restart Windows Explorer process if necessary
Event logging not working:
- Run application as administrator once to create Event Log source
- Verify Windows Event Log service is running
- Check Application Event Log for error messages
Protection not activating:
- Verify content is copied from a supported browser
- Ensure content matches known threat patterns
- Check Activity Log for detection messages
Review the Activity Log (accessible via right-click menu) for detailed information about:
- Clipboard monitoring operations
- Threat detection events
- Windows Event Log operations
- Application startup and initialization
For technical support or to report issues:
- Review the Activity Log for diagnostic information
- Check Windows Event Viewer for detailed error messages
- Ensure application is running with appropriate permissions
- Version: 1.0
- Target Framework: .NET 8.0
- Platform: Windows x64
- License: BSD 3-Clause License
This software is provided for security protection purposes. Users are responsible for ensuring compliance with local laws and organizational policies regarding clipboard monitoring and security software usage.
The application is designed to protect against malicious clipboard content and should not interfere with legitimate PowerShell usage when content originates from trusted sources or non-browser applications.