Renamed AutoIt Execution

Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.

Sigma rule (View on GitHub)

 1title: Renamed AutoIt Execution
 2id: f4264e47-f522-4c38-a420-04525d5b880f
 3status: experimental
 4description: |
 5    Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe.
 6    AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.
 7    Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.    
 8references:
 9    - https://twitter.com/malmoeb/status/1665463817130725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w
10    - https://www.autoitscript.com/site/
11author: Florian Roth (Nextron Systems)
12date: 2023/06/04
13modified: 2023/09/19
14tags:
15    - attack.defense_evasion
16    - attack.t1027
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection_1:
22        CommandLine|contains:
23            - ' /AutoIt3ExecuteScript'
24            - ' /ErrorStdOut'
25    selection_2:
26        - Imphash:
27              - 'fdc554b3a8683918d731685855683ddf'  # AutoIt v2 - doesn't cover all binaries
28              - 'cd30a61b60b3d60cecdb034c8c83c290'  # AutoIt v2 - doesn't cover all binaries
29              - 'f8a00c72f2d667d2edbb234d0c0ae000'  # AutoIt v3 - doesn't cover all binaries
30        - Hashes|contains:
31              - 'IMPHASH=FDC554B3A8683918D731685855683DDF'  # AutoIt v2 - doesn't cover all binaries
32              - 'IMPHASH=CD30A61B60B3D60CECDB034C8C83C290'  # AutoIt v2 - doesn't cover all binaries
33              - 'IMPHASH=F8A00C72F2D667D2EDBB234D0C0AE000'  # AutoIt v3 - doesn't cover all binaries
34    selection_3:
35        OriginalFileName:
36            - 'AutoIt3.exe'
37            - 'AutoIt2.exe'
38            - 'AutoIt.exe'
39    filter_main_legit_name:
40        Image|endswith:
41            - '\AutoIt.exe'
42            - '\AutoIt2.exe'
43            - '\AutoIt3_x64.exe'
44            - '\AutoIt3.exe'
45    condition: 1 of selection_* and not 1 of filter_main_*
46falsepositives:
47    - Unknown
48level: high

References

Related rules

to-top