AutoIt Interpreter Execution From an Unusual Location
Detects an AutoIt interpreter executing outside the usual AutoIt installation directories. Identification uses either the normal executable name or the AutoIt code-signing publisher, allowing Cortex XDR to identify many renamed copies without relying on the unsupported OriginalFileName Sigma field.
Sigma
