{
  "family": "cleanlog",
  "sample_count": 1,
  "category": "trojan",
  "description": "Trojan:Win32/Cleanlog is a specialized defense evasion tool utilized by advanced attackers (often post-exploitation) to deliberately cover their tracks. Its explicit purpose is to systematically delete, alter, or corrupt Windows Event Logs, application logs, and firewall histories (`T1070.001`). It is not an initial infection vector, but rather a utility used to hinder incident response investigations.<br><br><b>Understanding Cleanlog (Indicator Removal Tools)</b><br>To an end-user, the execution of Cleanlog is completely invisible. For a security operations center (SOC), the sudden clearing of security logs is the equivalent of a fire alarm. The presence of Cleanlog definitively proves that an attacker had full administrative or SYSTEM level access to the endpoint and is actively trying to hide malicious activity (like lateral movement or credential dumping).<br><br><b>Execution and Evasion Mechanics</b><br>Cleanlog must run with elevated privileges. It uses various Windows APIs and built-in tools (like `wevtutil.exe cl`) to target specific logs (Security, System, Application). Advanced variants may not just clear the logs, but selectively delete specific Event IDs related to the attacker's actions (`T1070.002`), making the tampering harder to detect than a massive log clearing event. It may also securely wipe dropped payloads from the disk (`T1070.004`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded forensic trail, making it difficult to determine the scope of the breach or the root cause. Host-based IoCs are highly specific: Event ID 1102 (The audit log was cleared) in the Security log, or Event ID 104 (The Application/System log was cleared) in the System log. EDR should flag the execution of `wevtutil` or unexpected API calls related to event log manipulation by non-standard processes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Cleanlog and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cleanlog is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cleanlog establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cleanlog typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Cleanlog compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Cleanlog should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Cleanlog?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cleanlog frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Cleanlog across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Cleanlog by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1070.004",
    "T1070.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1070.001",
      "name": "Indicator Removal: Clear Windows Event Logs (The primary function of the tool)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion (Securely wiping dropped payloads from disk)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Stopping logging services temporarily)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; if logs are being cleared, a high-severity breach has already occurred, and the attacker holds administrative privileges.",
    "Do not reboot the machine, as this may overwrite vital artifacts remaining in volatile memory (RAM). Capture a live memory dump immediately.",
    "Rely on centralized, forward-deployed log aggregation (SIEM) to reconstruct the timeline, as the local logs on the endpoint are no longer trustworthy.",
    "Hunt across the network for the administrative credentials the attacker used to deploy the Cleanlog utility."
  ],
  "what_to_avoid": [
    "Do not assume an endpoint is clean just because the local AV scans are negative; the attacker likely used Cleanlog to wipe the tools after using them.",
    "Avoid storing critical security logs solely on the endpoints; they must be forwarded to a centralized, immutable SIEM."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}