AutoHotKey Script Download for Automation Attack

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects the download of AutoHotKey (AHK) or AutoIt (AU3) script files over HTTP. These script files are often used for automation but can also be leveraged by attackers for malicious purposes, such as executing arbitrary code, keylogging, or other forms of automation in an attack chain. The rule specifically looks for HTTP responses where the URI contains file extensions '.ahk' or '.au3'.