HackTool - PowerTool Execution
Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files
Sigma rule (View on GitHub)
1title: HackTool - PowerTool Execution
2id: a34f79a3-8e5f-4cc3-b765-de00695452c2
3status: test
4description: Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files
5references:
6 - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
7 - https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html
8 - https://twitter.com/gbti_sa/status/1249653895900602375?lang=en
9 - https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2022-11-29
12modified: 2023-02-04
13tags:
14 - attack.defense-evasion
15 - attack.t1562.001
16logsource:
17 product: windows
18 category: process_creation
19detection:
20 selection:
21 - Image|endswith:
22 - '\PowerTool.exe'
23 - '\PowerTool64.exe'
24 - OriginalFileName: 'PowerTool.exe'
25 condition: selection
26falsepositives:
27 - Unlikely
28level: high
References
-
In June of 2022, we observed a threat actor gaining access to an environment via Emotet and operating over a eight day period. During this time period, multiple rounds of enumeration and lateral mo…
Read More -
Play is a new ransomware that takes a page out of Hive and Nokoyawa's playbook. The many similarities among them indicate that Play, like Nokoyawa, are operated by the same people.
Read More
Related rules
- AMSI Bypass Pattern Assembly GetType
- AWS CloudTrail Important Change
- AWS Config Disabling Channel/Recorder
- AWS GuardDuty Important Change
- Add SafeBoot Keys Via Reg Utility