Disclosed hacktool set (old stuff) - file CleanIISLog.exe

Hunt Hypothesis

This hunt detects adversaries deploying legacy or repurposed hacking tools like CleanIISLog.exe to manipulate IIS logs and obscure their presence within the environment. Proactive hunting for this behavior in Azure Sentinel is critical because such “old stuff” often evades standard signature-based defenses, allowing attackers to establish persistence and exfiltrate data through trusted-looking utilities before detection occurs.

YARA Rule

rule CleanIISLog {
	meta:
		description = "Disclosed hacktool set (old stuff) - file CleanIISLog.exe"
		author = "Florian Roth"
		date = "23.11.14"
		score = 60
		hash = "827cd898bfe8aa7e9aaefbe949d26298f9e24094"
	strings:
		$s1 = "CleanIP - Specify IP Address Which You Want Clear." fullword ascii
		$s2 = "LogFile - Specify Log File Which You Want Process." fullword ascii
		$s8 = "CleanIISLog Ver" fullword ascii
		$s9 = "msftpsvc" fullword ascii
		$s10 = "Fatal Error: MFC initialization failed" fullword ascii
		$s11 = "Specified \"ALL\" Will Process All Log Files." fullword ascii
		$s12 = "Specified \".\" Will Clean All IP Record." fullword ascii
		$s16 = "Service %s Stopped." fullword ascii
		$s20 = "Process Log File %s..." fullword ascii
	condition:
		5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 9 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the CleanIISLog.exe detection rule, including suggested filters and exclusions:

• Legacy IIS Maintenance Scheduled Task

  • Scenario: A nightly Windows Scheduled Task (Task Scheduler) configured by the infrastructure team runs CleanIISLog.exe to archive and rotate old IIS log files (.log, .txt) on web servers. This process executes automatically at 02:00 AM under a dedicated service account, mimicking the behavior of a “hacktool” scanning or modifying system logs.
  • Suggested Filter/Exclusion: Create an exclusion rule based on the Process Name (CleanIISLog.exe) AND Parent Process (svchost.exe or TaskScheduler.exe). Additionally, restrict the detection to only trigger if the process is running outside of business hours (e.g., 02:00–04:00) and originates from a specific “WebServer” OU.

• Third-Party Security Suite Log Cleanup Module

  • Scenario: An enterprise endpoint protection suite (e.g., Trend Micro, McAfee, or Symantec) includes a built-in module named CleanIISLog.exe that periodically cleans up temporary logs generated by the antivirus engine’s web console. This is often triggered during the daily “Health Check” routine.
  • Suggested Filter/Exclusion: Exclude files where the Publisher matches the specific security vendor (e.g., Trend Micro Incorporated) and the file path resides within the vendor’s installation directory (e.g., C:\Program Files\Trend Micro\...). Verify the digital signature is valid before allowing.

• Post-Deployment Configuration Script Execution

  • Scenario: During a standard application deployment or IIS update, DevOps engineers