{
  "family": "cleanlog",
  "sample_count": 1,
  "category": "trojan",
  "description": "Trojan:Win32/Cleanlog is a specialized defense evasion tool utilized by advanced attackers (often post-exploitation) to deliberately cover their tracks. Its explicit purpose is to systematically delete, alter, or corrupt Windows Event Logs, application logs, and firewall histories (`T1070.001`). It is not an initial infection vector, but rather a utility used to hinder incident response investigations.<br><br><b>Understanding Cleanlog (Indicator Removal Tools)</b><br>To an end-user, the execution of Cleanlog is completely invisible. For a security operations center (SOC), the sudden clearing of security logs is the equivalent of a fire alarm. The presence of Cleanlog definitively proves that an attacker had full administrative or SYSTEM level access to the endpoint and is actively trying to hide malicious activity (like lateral movement or credential dumping).<br><br><b>Execution and Evasion Mechanics</b><br>Cleanlog must run with elevated privileges. It uses various Windows APIs and built-in tools (like `wevtutil.exe cl`) to target specific logs (Security, System, Application). Advanced variants may not just clear the logs, but selectively delete specific Event IDs related to the attacker's actions (`T1070.002`), making the tampering harder to detect than a massive log clearing event. It may also securely wipe dropped payloads from the disk (`T1070.004`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a severely degraded forensic trail, making it difficult to determine the scope of the breach or the root cause. Host-based IoCs are highly specific: Event ID 1102 (The audit log was cleared) in the Security log, or Event ID 104 (The Application/System log was cleared) in the System log. EDR should flag the execution of `wevtutil` or unexpected API calls related to event log manipulation by non-standard processes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1070.004",
    "T1070.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1070.001",
      "name": "Indicator Removal: Clear Windows Event Logs (The primary function of the tool)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1070.004",
      "name": "Indicator Removal: File Deletion (Securely wiping dropped payloads from disk)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Stopping logging services temporarily)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint immediately; if logs are being cleared, a high-severity breach has already occurred, and the attacker holds administrative privileges.",
    "Do not reboot the machine, as this may overwrite vital artifacts remaining in volatile memory (RAM). Capture a live memory dump immediately.",
    "Rely on centralized, forward-deployed log aggregation (SIEM) to reconstruct the timeline, as the local logs on the endpoint are no longer trustworthy.",
    "Hunt across the network for the administrative credentials the attacker used to deploy the Cleanlog utility."
  ],
  "what_to_avoid": [
    "Do not assume an endpoint is clean just because the local AV scans are negative; the attacker likely used Cleanlog to wipe the tools after using them.",
    "Avoid storing critical security logs solely on the endpoints; they must be forwarded to a centralized, immutable SIEM."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}