Grixba Infostealer - Windows Event Log Clearing via GT_NET.exe (CLR Mode)

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•7

Detects execution of processes associated with Grixba malware (GT_NET.exe) or suspicious attempts to clear Windows event logs using built-in utilities (wevtutil, wmic) in conjunction with common command shells or the malware itself.