DarkGate - Autoit3.EXE File Creation By Uncommon Process

SigmaHQ Detections@sigmaHQ

•updated Sep 2, 2024•0•55

Detects the creation of 'Autoit3.exe' by uncommon or suspicious processes such as 'curl.exe', 'KeyScramblerLogon.exe', 'ExtExport.exe', or 'wmprph.exe'. This activity is associated with DarkGate malware, which leverages 'Autoit3.exe' to execute shellcode for process injection and C2 communication. The identified parent processes are considered non-standard for creating this executable.