{
  "family": "clearlog",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Clearlog is a critical **Heuristic Detection** specifically designed to flag executables, scripts, or command-line activity attempting to wipe the Windows Security, Application, or System Event Logs. This is not a specific malware family, but a detection of a core Defense Evasion tactic (`T1070.001`). Legitimate system administrators rarely clear security logs; therefore, this action is almost exclusively associated with attackers or advanced malware attempting to erase forensic evidence of a breach.<br><br><b>Understanding Clearlog (Defense Evasion)</b><br>To an end-user, this action is invisible. For a SOC analyst, a Clearlog alert is an absolute, 'hair-on-fire' emergency. It means an attacker has not only compromised the system but has achieved administrative privileges (required to clear security logs) and is actively trying to hide their lateral movement, privilege escalation, or exfiltration activities.<br><br><b>Execution and Evasion Mechanics</b><br>Attackers trigger this detection by using built-in Windows utilities (Living off the Land) or custom scripts. Common methods include executing `wevtutil cl System` or `wevtutil cl Security` from a command prompt (`T1059.003`), using the PowerShell cmdlet `Clear-EventLog`, or utilizing WMI methods. Sophisticated malware might interact directly with the Windows Event Log API to selectively delete specific records, though bulk clearing is more common. This action permanently destroys the local forensic trail of the attacker's initial access and subsequent actions.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the devastating loss of forensic visibility on the compromised endpoint. The primary IoC *is* the alert itself. Host-based IoCs include EDR telemetry logging the execution of `wevtutil.exe` with the `cl` (clear) flag. Paradoxically, the Windows Event Log generates a final event before being wiped: **Event ID 1102 (The audit log was cleared)**. The presence of this specific Event ID is the definitive indicator of a successful Clearlog action.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.003",
    "T1059.001",
    "T1070.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1070.001",
      "name": "Indicator Removal on Host: Clear Windows Event Logs",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell (Using Clear-EventLog)",
      "tactic": "Execution"
    },
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell (Using wevtutil)",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "IMMEDIATELY isolate the endpoint from the network; the attacker possesses administrative privileges and is actively destroying evidence.",
    "Preserve RAM immediately. Since the disk-based logs are destroyed, volatile memory is the only remaining source of forensic artifacts.",
    "Correlate the timestamp of the log clearing with centralized SIEM logs (if logs are forwarded) to determine what actions occurred immediately prior to the wipe.",
    "Initiate a major incident response protocol; assume the attacker has full administrative control and is likely moving laterally."
  ],
  "what_to_avoid": [
    "Do not reboot the machine; this will destroy the volatile memory (RAM), which is critical now that the disk logs are gone.",
    "Avoid assuming the attack was a failure just because evidence is missing; log clearing is the hallmark of a successful, professional intrusion."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}