{
  "family": "clearlog",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Clearlog is a critical **Heuristic Detection** specifically designed to flag executables, scripts, or command-line activity attempting to wipe the Windows Security, Application, or System Event Logs. This is not a specific malware family, but a detection of a core Defense Evasion tactic (`T1070.001`). Legitimate system administrators rarely clear security logs; therefore, this action is almost exclusively associated with attackers or advanced malware attempting to erase forensic evidence of a breach.<br><br><b>Understanding Clearlog (Defense Evasion)</b><br>To an end-user, this action is invisible. For a SOC analyst, a Clearlog alert is an absolute, 'hair-on-fire' emergency. It means an attacker has not only compromised the system but has achieved administrative privileges (required to clear security logs) and is actively trying to hide their lateral movement, privilege escalation, or exfiltration activities.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers trigger this detection by using built-in Windows utilities (Living off the Land) or custom scripts. Common methods include executing `wevtutil cl System` or `wevtutil cl Security` from a command prompt (`T1059.003`), using the PowerShell cmdlet `Clear-EventLog`, or utilizing WMI methods. Sophisticated malware might interact directly with the Windows Event Log API to selectively delete specific records, though bulk clearing is more common. This action permanently destroys the local forensic trail of the attacker's initial access and subsequent actions.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating loss of forensic visibility on the compromised endpoint. The primary IoC *is* the alert itself. Host-based IoCs include EDR telemetry logging the execution of `wevtutil.exe` with the `cl` (clear) flag. Paradoxically, the Windows Event Log generates a final event before being wiped: **Event ID 1102 (The audit log was cleared)**. The presence of this specific Event ID is the definitive indicator of a successful Clearlog action.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Clearlog and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clearlog is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Clearlog establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clearlog typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Clearlog compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Clearlog should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Clearlog leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clearlog frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Clearlog maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Clearlog often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1059.001",
    "T1070.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1070.001",
      "name": "Indicator Removal on Host: Clear Windows Event Logs",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Using Clear-EventLog)",
      "tactic": "Execution"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Using wevtutil)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "IMMEDIATELY isolate the endpoint from the network; the attacker possesses administrative privileges and is actively destroying evidence.",
    "Preserve RAM immediately. Since the disk-based logs are destroyed, volatile memory is the only remaining source of forensic artifacts.",
    "Correlate the timestamp of the log clearing with centralized SIEM logs (if logs are forwarded) to determine what actions occurred immediately prior to the wipe.",
    "Initiate a major incident response protocol; assume the attacker has full administrative control and is likely moving laterally."
  ],
  "what_to_avoid": [
    "Do not reboot the machine; this will destroy the volatile memory (RAM), which is critical now that the disk logs are gone.",
    "Avoid assuming the attack was a failure just because evidence is missing; log clearing is the hallmark of a successful, professional intrusion."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}