Windows PowerTool Process Execution
Flags Windows process creation events where PowerTool.exe/PowerTool64.exe is launched.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-11-29
- Updated
- 2026-07-31
ATT&CK techniques
Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches process creation events where the executed binary is PowerTool.exe or PowerTool64.exe. PowerTool can perform defense-impairment actions such as killing processes, deleting files, and unloading or deleting driver components. The detection relies on Windows process creation telemetry, specifically the image path ending with the target executable name and the OriginalFileName field.
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- trendmicro.comhttps://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html
- twitter.comhttps://twitter.com/gbti_sa/status/1249653895900602375?lang=en
- softpedia.comhttps://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_powertool.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerTool Process Execution
id: c4678383-dd0e-4c8b-9a98-9e5d638a98f6
status: test
description: This rule matches process creation events where the executed binary is PowerTool.exe or PowerTool64.exe. PowerTool can perform defense-impairment actions such as killing processes, deleting files, and unloading or deleting driver components. The detection relies on Windows process creation telemetry, specifically the image path ending with the target executable name and the OriginalFileName field.
references:
- https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
- https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html
- https://twitter.com/gbti_sa/status/1249653895900602375?lang=en
- https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_powertool.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-11-29
modified: 2023-02-04
tags:
- attack.defense-impairment
- attack.t1685
logsource:
product: windows
category: process_creation
detection:
selection:
- Image|endswith:
- \PowerTool.exe
- \PowerTool64.exe
- OriginalFileName: PowerTool.exe
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: a34f79a3-8e5f-4cc3-b765-de00695452c2
type: derived