Cleanlog

Overview

Trojan:Win32/Cleanlog is a specialized defense evasion tool utilized by advanced attackers (often post-exploitation) to deliberately cover their tracks. Its explicit purpose is to systematically delete, alter, or corrupt Windows Event Logs, application logs, and firewall histories (`T1070.001`). It is not an initial infection vector, but rather a utility used to hinder incident response investigations.

Understanding Cleanlog (Indicator Removal Tools)
To an end-user, the execution of Cleanlog is completely invisible. For a security operations center (SOC), the sudden clearing of security logs is the equivalent of a fire alarm. The presence of Cleanlog definitively proves that an attacker had full administrative or SYSTEM level access to the endpoint and is actively trying to hide malicious activity (like lateral movement or credential dumping).

Execution and Evasion Mechanics
Cleanlog must run with elevated privileges. It uses various Windows APIs and built-in tools (like `wevtutil.exe cl`) to target specific logs (Security, System, Application). Advanced variants may not just clear the logs, but selectively delete specific Event IDs related to the attacker's actions (`T1070.002`), making the tampering harder to detect than a massive log clearing event. It may also securely wipe dropped payloads from the disk (`T1070.004`).

Indicators of Compromise & Impact
The impact is a severely degraded forensic trail, making it difficult to determine the scope of the breach or the root cause. Host-based IoCs are highly specific: Event ID 1102 (The audit log was cleared) in the Security log, or Event ID 104 (The Application/System log was cleared) in the System log. EDR should flag the execution of `wevtutil` or unexpected API calls related to event log manipulation by non-standard processes.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_CLEANLOG {
    meta:
        description = "Detects Cleanlog (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "cleanlog" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Cleanlog Activity
id: 77629507a2edd59e42acfcf9abc85f6f
status: experimental
description: Detects generic indicators of the cleanlog malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*cleanlog*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint immediately; if logs are being cleared, a high-severity breach has already occurred, and the attacker holds administrative privileges.
2. Do not reboot the machine, as this may overwrite vital artifacts remaining in volatile memory (RAM). Capture a live memory dump immediately.
3. Rely on centralized, forward-deployed log aggregation (SIEM) to reconstruct the timeline, as the local logs on the endpoint are no longer trustworthy.
4. Hunt across the network for the administrative credentials the attacker used to deploy the Cleanlog utility.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume an endpoint is clean just because the local AV scans are negative; the attacker likely used Cleanlog to wipe the tools after using them.
2. Avoid storing critical security logs solely on the endpoints; they must be forwarded to a centralized, immutable SIEM.

References & External Analysis

• Search "cleanlog" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Firehooker
• Glupteba
• Genericrxce
• Collector
• Rkit

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/cleanlog.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.