I recently came across this interesting post on X documenting an approach to dumping File Drop Lists from the clipboard. Documenting my 5 mins of research into this topic.

What is a File Drop List ?

A file drop list in Windows is a collection of strings that contain file path information. It is stored in the Clipboard as a String array.

Consider the following data in a Notepad document.

Let’s highlight the lines and Copy (Ctrl+C). The data should be on the clipboard.

How does it look on the clipboard ?

Hit Win + V to view the current data (and history) on the Clipboard Viewer.

Using powershell to extract this list

PS> Add-Type -an System.Windows.Forms | Out-Null;
PS> [System.Windows.Forms.Clipboard]::ContainsFileDropList();

Clearly a list of file paths does not constitute a File Drop List.

Let’s try this again. Select a list of files from Windows Explorer and Copy to the clipboard.

We run the powershell command again. This time the invocation returns True.

Let’s use GetFileDropList() to retrieve this list. This time we see the files that were copied to the clipboard.

PS>[System.Windows.Forms.Clipboard]::GetFileDropList();

Potential Uses

The Copy-Paste routine is used frequently in Explorer to copy files between locations. A record of these files is maintained on the Clipboard and this command could be used by a payload/implant to exfiltrate data about files being copied on the target system, back to the C2.

Resources:

• https://learn.microsoft.com/en-us/dotnet/api/system.windows.forms.clipboard.getfiledroplist?view=windowsdesktop-8.0
• https://learn.microsoft.com/en-us/windows/win32/shell/dragdrop
• https://x.com/guyrleech/status/1843314206118121883