Script Execution from Staging Directory

Mehulkumar Savajani@Msavajani

•updated Dec 22, 2025•42•3•363

Detects the execution of AutoHotKey (.ahk) or AutoIt (.au3) scripts from common staging directories such as C:\Users\Public\ or C:\Temp\. This is a known technique used by malware like DarkGate to stage and execute its payload.