AutoIT3 process injection into charmap.exe via Windows API calls
Detects autoit3.exe invoking process injection Windows APIs (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, CloseHandle) from kernel32.dll targeting the legitimate charmap.exe process, consistent with the AutoIT payload injector chain delivering VIPKeylogger/MedusaHVNC.
Microsoft Sentinel (KQL)
