Any self-respecting malware writer will download and decompile the Powertools to find out what API calls are being used. Especially if they’re calls to an undocumented API.
Having Powertools on your computer is thus not the security hole it might appear to be.
The fact they exist at all - well that’s not really a security hole either. Their existence just more quickly dissolves any security-by-obscurity that might have existed. Someone would have found those calls another way.
One might suppose that they contain something special that’s not in the stock OS, but then we’re back to the malware writer’s reverse engineering which would lead them to learn and implement their own versions of whatever it is that Powertools does.
will download and decompile the Powertools
PowerToys is open-source, so no need to decompile. https://github.com/microsoft/PowerToys.
This is the code that determines which processes are holding on to the specified files (or any files in the specified folders): https://github.com/microsoft/PowerToys/blob/a89f9f69768ace73de21dbf6020bd7fa2460bf4a/src/modules/FileLocksmith/FileLocksmithLibInterop/FileLocksmith.cpp#L18
Called from the UI code here: https://github.com/microsoft/PowerToys/blob/a89f9f69768ace73de21dbf6020bd7fa2460bf4a/src/modules/FileLocksmith/FileLocksmithUI/ViewModels/MainViewModel.cs#L112 which also has the code to kill the processes
I would not say
any self-respecting malware writer will download [powertools] and…
I’m not as familiar with mass-market malware, but APT-level gear generally doesn’t try to make use of such easily observed events. The more network traffic malware appropriates, the greater the probability that it’s caught.
Simply put, Powertools puts several functions within arms reach for malware looking to stay under the radar. Without it, malware needs to bring more of its own code which increases footprint. Living off the land exploits in particular love the presence of these kinds of programs
