Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Clop – DLL Injection Paired with Windows Event Log Clearing

Clop Defense Evasion Sentinel
MITRE ATT&CK
Dynamic-link Library Injection
Data Source
DeviceProcessEvents
Date Added
2026-07-23
Last Updated
2026-07-23
Source
ransomware.live ttps dataset (clop)
What This Detects
Separately from its initial-access exploitation pattern, Clop's post-exploitation TTPs include DLL injection paired with clearing Windows event logs to erase traces of the intrusion — flags the pairing on the same host.
Query
let logClear = DeviceProcessEvents
| where Timestamp > ago(1d)
| where FileName =~ "wevtutil.exe" and ProcessCommandLine has "cl "
| project DeviceName, ClearTime = Timestamp;
let dllInject = DeviceEvents
| where Timestamp > ago(1d)
| where ActionType has "InjectedDll" or ActionType has "ProcessInjection"
| project DeviceName, InjectTime = Timestamp;
logClear
| join kind=inner dllInject on DeviceName
| where InjectTime - ClearTime between (-2h .. 2h)

Hunting queries are starting points for threat hunting & detection engineering — validate table/column names against your own workspace schema and tune thresholds before turning any of these into a production alert rule.