AutoIT Compiled Script Payload Download

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the download of a compiled AutoIT script payload over HTTP. It specifically looks for the 'AU3!' magic bytes at the beginning of the file data, which is characteristic of compiled AutoIT executables. The detection is focused on traffic flowing from the server to the client (to_client) and assumes an established connection.