087. Detecting Ransomware Affiliate's Toolkit: PowerTool
Hello everyone! Another day - another tool. This time it's not a regular tool, but PowerTool ! This is another popular tool abused by ransomware gangs to disable security controls. For example, it's used by Akira ransomware affiliates. Let's start from process creation events: event_type: "processcreatewin" AND (proc_file_productname: "PowerTool" OR proc_file_originalfilename: "PowerTool.exe") One more thing - PowerTool's driver loading: event_type: "processmoduleload" AND file_productname: "PowerTool" Want more? Here's the sample ! See you tomorrow!