When the above sequence occurs, the
NtUserGetClipboardData kernel mode function is called by Microsoft Office applications in the back-end. The Microsoft Office applications being called in the back-end confirm that Microsoft Office applications access the Windows Clipboard data. Trellix worked with Microsoft and obtained the following confirmation:
"Office Applications are designed to access the Windows Clipboard data (if previously a copy action was performed) even before the user tries to Paste anything."
NOTE: This behavior is standard for Microsoft Office applications.