DarkGate Loader Dropped in C:\Temp Directory

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•36

Detects the dropping and potential execution of DarkGate loader components, specifically AutoIt scripts (.au3) or compiled AutoIt executables (autoit3.exe), within the C:\temp directory. This activity is indicative of DarkGate malware infection attempts, often leveraging vulnerabilities like CVE-2024-21412.