DarkGate - Autoit3.EXE Execution from Suspicious Parent
This rule detects the execution of 'Autoit3.exe' when it is spawned by suspicious parent processes such as 'cmd.exe', 'KeyScramblerLogon.exe', or 'msiexec.exe'. It specifically filters out legitimate executions of 'Autoit3.exe' from standard installation paths to reduce false positives. This activity is indicative of the DarkGate malware infection chain, which leverages AutoIt3.exe to execute shellcode for process injection and command-and-control communication.
Sigma
