AutoJack RCE: Suspicious Child Process Spawned by autogenstudio

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects instances where the AutoGen Studio process, or a process with 'autogenstudio' in its command line, initiates suspicious subprocesses such as command shells (cmd, powershell, bash, sh) or common living-off-the-land binaries (certutil, mshta, rundll32, regsvr32, curl, wget, bitsadmin, python). This behavior is characteristic of an adversary leveraging a potentially vulnerable application to execute arbitrary code on the underlying system.