HackTool - PowerTool Execution

 1title: HackTool - PowerTool Execution
 2id: a34f79a3-8e5f-4cc3-b765-de00695452c2
 3status: test
 4description: Detects the execution of the tool PowerTool which has the ability to kill a process, delete its process file, unload drivers, and delete the driver files
 5references:
 6    - https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/
 7    - https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html
 8    - https://twitter.com/gbti_sa/status/1249653895900602375?lang=en
 9    - https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml
10author: Nasreddine Bencherchali (Nextron Systems)
11date: 2022/11/29
12modified: 2023/02/04
13tags:
14    - attack.defense_evasion
15    - attack.t1562.001
16logsource:
17    product: windows
18    category: process_creation
19detection:
20    selection:
21        - Image|endswith:
22              - '\PowerTool.exe'
23              - '\PowerTool64.exe'
24        - OriginalFileName: 'PowerTool.exe'
25    condition: selection
26falsepositives:
27    - Unlikely
28level: high

References

• Emotet Strikes Again - LNK File Leads to Domain Wide Ransomware - The DFIR Report

  

  In June of 2022, we observed a threat actor gaining access to an environment via Emotet and operating over a eight day period. During this time period, multiple rounds of … Read More

  
  Read More

• Play Ransomware Attack Playbook Similar to that of Hive, Nokoyawa

  

  Play is a new ransomware that takes a page out of Hive and Nokoyawa's playbook. The many similarities among them indicate that Play, like Nokoyawa, are operated by the same people.

  
  Read More

• Something went wrong, but don’t fret — let’s give it another shot.

  
  Read More

• Download PowerTool

  

  Download PowerTool 4.8 x86 / 2.0 x64 - A rather small application in stature but powerful enough to detect kernel alterations that occur due to the presence of various malware components

  
  Read More

Related rules

• Powershell Base64 Encoded MpPreference Cmdlet
• SafeBoot Registry Key Deleted Via Reg.EXE
• Service Registry Key Deleted Via Reg.EXE
• Suspicious Windows Defender Folder Exclusion Added Via Reg.EXE
• Load Of RstrtMgr.DLL By A Suspicious Process