Detect AutoHotKey & AutoIT in IBM QRadar
Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks such as clicking buttons, entering text, and managing programs. Adversaries may use AHK (.ahk) and AutoIT (.au3) scripts to execute malicious code, deploy keyloggers, and deliver phishing payloads. These scripts can be compiled into self-contained executables. Threat actors including DarkGate, Lumma Stealer, APT39, and XLoader have leveraged AutoIT and AutoHotKey for malware delivery and execution.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.010 AutoHotKey & AutoIT
- Canonical reference
- https://attack.mitre.org/techniques/T1059/010/
QRadar Detection Query
SELECT
DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
logsourcename(logsourceid) AS log_source,
sourceip,
username,
"Image" AS process_image,
"CommandLine" AS command_line,
"ParentImage" AS parent_image,
CASE
WHEN "Image" ILIKE '%AutoIt3.exe' OR "CommandLine" ILIKE '%.au3%' THEN 1
ELSE 0
END AS is_autoit,
CASE
WHEN "Image" ILIKE '%AutoHotkey%' OR "CommandLine" ILIKE '%.ahk%' THEN 1
ELSE 0
END AS is_ahk,
CASE
WHEN "CommandLine" ILIKE '%\Temp\%' OR "CommandLine" ILIKE '%AppData%' OR "CommandLine" ILIKE '%\tmp\%' THEN 2
ELSE 0
END AS temp_score,
CASE
WHEN "CommandLine" ILIKE '%URLDownloadToFile%' OR "CommandLine" ILIKE '%_WinHttpSimpleRequest%' OR "CommandLine" ILIKE '%Inet%' THEN 2
ELSE 0
END AS network_score,
CASE
WHEN "CommandLine" ILIKE '%DllCall(%' THEN 2
ELSE 0
END AS dll_score,
CASE
WHEN "CommandLine" ILIKE '%URLDownloadToFile%' OR "CommandLine" ILIKE '%_WinHttpSimpleRequest%' OR "CommandLine" ILIKE '%Inet%' THEN 2
ELSE 0
END +
CASE
WHEN "CommandLine" ILIKE '%\Temp\%' OR "CommandLine" ILIKE '%AppData%' THEN 2
ELSE 0
END +
CASE
WHEN "CommandLine" ILIKE '%DllCall(%' THEN 2
ELSE 0
END AS suspicion_score
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
AND QIDNAME(qid) IN ('Process Create', 'A new process has been created')
AND (
"Image" ILIKE '%AutoIt3.exe'
OR "Image" ILIKE '%AutoHotkey.exe'
OR "Image" ILIKE '%AutoHotkeyU64.exe'
OR "Image" ILIKE '%AutoHotkeyU32.exe'
OR "CommandLine" ILIKE '%.au3%'
OR "CommandLine" ILIKE '%.ahk%'
)
AND devicetime > (NOW() - 86400000)
ORDER BY suspicion_score DESC, devicetime DESC
LIMIT 500Detects AutoIT and AutoHotKey script execution via QRadar by querying process creation events from Sysmon or Windows Security logs. Scores events based on suspicious indicators: script execution from temp/AppData directories, network download functions, and DLL calls. Higher suspicion scores indicate more likely malicious activity aligned with T1059.010 threat actor TTPs.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise automation tools built on AutoHotKey for standardized workflows across the organization such as form-filling bots or data entry automation
- AutoIT-packaged legitimate software that bundles the AutoIT runtime as part of its installer or runtime environment
- Security tools or pentest frameworks that use AutoHotKey for UI automation during authorized assessments
Other platforms for T1059.010
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AutoHotKey Script Execution
Expected signal: Sysmon Event ID 1: Process Create for AutoHotkey.exe with .ahk file in CommandLine. Sysmon Event ID 11: File Create for the .ahk script in Temp directory.
- Test 2AutoIT Script Execution
Expected signal: Sysmon Event ID 1: Process Create for AutoIt3.exe with .au3 file in CommandLine. Sysmon Event ID 11: File Create for the .au3 script in Temp directory.
- Test 3AutoIT Compiled Executable Detection
Expected signal: Sysmon Event ID 1: PowerShell process creation. The script scans for compiled AutoIT executables by checking PE metadata.
References (5)
- https://attack.mitre.org/techniques/T1059/010/
- https://www.splunk.com/en_us/blog/security/enter-the-gates-an-analysis-of-the-darkgate-autoit-loader.html
- https://www.autoitscript.com/autoit3/docs/intro/running.htm
- https://www.autohotkey.com/docs/v1/Program.htm
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.010/T1059.010.md
Unlock Pro Content
Get the full detection package for T1059.010 including response playbook, investigation guide, and atomic red team tests.