As long as there is one ClipboardChange rule active, Sysmon seems to log all clipboard activity to the Archive folder.
Tested version: noticed in Sysmon64 12.02, same behavior in Sysmon64 13.01
<RuleGroup name="" groupRelation="or"> <ClipboardChange onmatch="include"> <Image condition="image">windowsterminal.exe</Image> </ClipboardChange> </RuleGroup>
With this config, Sysmon logs EventIDs 24 as expected when I copy data from a Terminal window, and nothing outside of that. However, the Archive folder gets filled with all kinds of clipboard events happening outside of Terminal.
Playing with the "CaptureClipboard" configuration entry doesn't seem to change anything.
Is this expected behavior?
Beyond that, would it be possible to have a configuration setting where clipboard events get logged to the evtx log, without writing the actual data to the Archive directory?