Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
34
7
6
3
3
Contributors
10
9
8
5
4
Categories
32
23
19
10
9
Platforms
51
5
1
1
Products / Services
28
9
7
3
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
3
IDS Protocols
3
Detects the execution of AutoHotKey (.ahk) or AutoIt (.au3) scripts from common staging directories such as C:\Users\Public\ or C:\Temp\. This is a known technique used by malware like DarkGate to stage and execute its payload.
Detects the execution of the AutoHotKey interpreter (AutoHotKey.exe) as a child process of common initial access applications like web browsers, Microsoft Office products, or command-line interpreters. This behavior is a key indicator of the latest DarkGate malware infection chain.
The following analytic detects the execution of AutoIt3, a scripting language often used for automating Windows GUI tasks and general scripting. It identifies instances where AutoIt3 or its variants are executed by searching for process names or original file names matching 'autoit3.exe'. This activity is significant because attackers frequently use AutoIt3 to automate malicious actions, such as executing malware. If confirmed malicious, this activity could lead to unauthorized code execution, system compromise, or further propagation of malware within the environment.
KQL Query from file: Hunting New Variant of Snake Keylogger
KQL Query from file: CVSS 9.8 Rockwell Automation Impacted by High-Severity log4net Vulnerability
Identifies suspicious access to sensitive browser files by processes commonly used by Lumma Stealer, expanding coverage to include more browsers based on observed configurations.
The following analytic identifies instances of the WinDBG process spawning AutoIt3. This behavior is detected by monitoring endpoint telemetry for processes where 'windbg.exe' is the parent process and 'autoit3.exe' or similar is the child process. This activity is significant because AutoIt3 is frequently used by threat actors for scripting malicious automation, potentially indicating an ongoing attack. If confirmed malicious, this could allow attackers to automate tasks, execute arbitrary code, and further compromise the system, leading to data exfiltration or additional malware deployment.
Detects the dropping and potential execution of DarkGate loader components, specifically AutoIt scripts (.au3) or compiled AutoIt executables (autoit3.exe), within the C:\temp directory. This activity is indicative of DarkGate malware infection attempts, often leveraging vulnerabilities like CVE-2024-21412.
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
Detects the creation of 'Autoit3.exe' by uncommon or suspicious processes such as 'curl.exe', 'KeyScramblerLogon.exe', 'ExtExport.exe', or 'wmprph.exe'. This activity is associated with DarkGate malware, which leverages 'Autoit3.exe' to execute shellcode for process injection and C2 communication. The identified parent processes are considered non-standard for creating this executable.
This rule detects the execution of 'Autoit3.exe' when it is spawned by suspicious parent processes such as 'cmd.exe', 'KeyScramblerLogon.exe', or 'msiexec.exe'. It specifically filters out legitimate executions of 'Autoit3.exe' from standard installation paths to reduce false positives. This activity is indicative of the DarkGate malware infection chain, which leverages AutoIt3.exe to execute shellcode for process injection and command-and-control communication.
This rule detects the execution of the AutoHotkey.exe binary when it has been renamed. It identifies this by looking for specific PE metadata fields such as 'Product' or 'Description' containing 'AutoHotkey', or 'OriginalFileName' being 'AutoHotkey.exe' or 'AutoHotkey.rc', while simultaneously filtering out executions where the image path ends with or contains the legitimate 'AutoHotkey.exe' or its variants.
Page 3 of 3