Renamed AutoHotkey.EXE Execution
This rule detects the execution of the AutoHotkey.exe binary when it has been renamed. It identifies this by looking for specific PE metadata fields such as 'Product' or 'Description' containing 'AutoHotkey', or 'OriginalFileName' being 'AutoHotkey.exe' or 'AutoHotkey.rc', while simultaneously filtering out executions where the image path ends with or contains the legitimate 'AutoHotkey.exe' or its variants.
Sigma
