908b25bccb
it was "clip" that is already covered by "clipboard]::". Real value is "&&" . Reference: Sigma Rule Id: 4edf51e1-cb83-4e1a-bc39-800e396068e3 Link: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml