Windows PowerTool Execution via PowerTool.exe or PowerTool64.exe Process Creation

title: Windows PowerTool Execution via PowerTool.exe or PowerTool64.exe Process Creation
id: c4678383-dd0e-4c8b-9a98-9e5d638a98f6
status: test
description: This rule identifies execution of the Windows utility PowerTool by matching process start events for PowerTool.exe or PowerTool64.exe. PowerTool is capable of defense-impairment behaviors such as killing processes, removing process files, unloading drivers, and deleting driver files, making its execution a high-signal indicator of hostile tooling. It relies on Windows process creation telemetry, including the executed image path ending in PowerTool.exe/PowerTool64.exe and the OriginalFileName value.
references:
  - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
  - https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html
  - https://twitter.com/gbti_sa/status/1249653895900602375?lang=en
  - https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_powertool.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-29
modified: 2023-02-04
tags:
  - attack.defense-impairment
  - attack.t1685
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    - Image|endswith:
        - \PowerTool.exe
        - \PowerTool64.exe
    - OriginalFileName: PowerTool.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: a34f79a3-8e5f-4cc3-b765-de00695452c2
    type: derived