PUP Fangs - Process Tree Progression to AutoIt (T1059)

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Tracks the escalation of a Potentially Unwanted Program (PUP) installer executing wscript.exe, which then spawns powershell.exe, finally culminating in the execution of the AutoIt3 interpreter. This sequence is indicative of a common Remote Access Trojan (RAT) loader technique.