Detect AutoHotKey & AutoIT in Sumo Logic CSE
Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks such as clicking buttons, entering text, and managing programs. Adversaries may use AHK (.ahk) and AutoIT (.au3) scripts to execute malicious code, deploy keyloggers, and deliver phishing payloads. These scripts can be compiled into self-contained executables. Threat actors including DarkGate, Lumma Stealer, APT39, and XLoader have leveraged AutoIT and AutoHotKey for malware delivery and execution.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.010 AutoHotKey & AutoIT
- Canonical reference
- https://attack.mitre.org/techniques/T1059/010/
Sumo Detection Query
_sourceCategory=windows/sysmon OR _sourceCategory=windows/security
| where EventID = "1" or EventCode = "4688"
| where Image matches "*AutoIt3.exe" or Image matches "*AutoHotkey.exe" or Image matches "*AutoHotkeyU64.exe" or Image matches "*AutoHotkeyU32.exe" or CommandLine matches "*.au3*" or CommandLine matches "*.ahk*"
| eval is_autoit = if(Image matches "*AutoIt3.exe" or CommandLine matches "*.au3*", 1, 0)
| eval is_ahk = if(Image matches "*AutoHotkey*" or CommandLine matches "*.ahk*", 1, 0)
| eval script_from_temp = if(CommandLine matches "*\\Temp\\*" or CommandLine matches "*\\tmp\\*" or CommandLine matches "*AppData*", 1, 0)
| eval network_activity = if(CommandLine matches "*URLDownloadToFile*" or CommandLine matches "*_WinHttpSimpleRequest*" or CommandLine matches "*Inet*", 1, 0)
| eval dll_call = if(CommandLine matches "*DllCall(*", 1, 0)
| eval key_logging = if(CommandLine matches "*Hotkey,*" or CommandLine matches "*SetKeyDelay,*" or CommandLine matches "*SendInput,*" or CommandLine matches "*Send,*", 1, 0)
| eval suspicion_score = (script_from_temp * 2) + (network_activity * 2) + (dll_call * 2) + (key_logging * 2)
| fields _messageTime, Computer, User, Image, CommandLine, ParentImage, ParentCommandLine, is_autoit, is_ahk, script_from_temp, network_activity, dll_call, key_logging, suspicion_score
| sort by suspicion_score desc, _messageTime descDetects execution of AutoIT and AutoHotKey scripting engines in Sumo Logic using Sysmon process creation (Event ID 1) or Windows Security process creation (Event ID 4688). Enriches events with flags for suspicious behaviors: temp directory execution, network download functions, DLL calls, and keylogging API usage. Supports hunting for T1059.010 techniques used by commodity malware families.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate productivity automation scripts distributed by IT that use AutoHotKey for remapping keys or automating repetitive desktop tasks
- Application packaging solutions that compile AutoIT scripts into EXEs for software distribution across the enterprise
- Automated testing pipelines for Windows GUI applications that rely on AutoIT or AutoHotKey for driving the user interface during QA
Other platforms for T1059.010
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1AutoHotKey Script Execution
Expected signal: Sysmon Event ID 1: Process Create for AutoHotkey.exe with .ahk file in CommandLine. Sysmon Event ID 11: File Create for the .ahk script in Temp directory.
- Test 2AutoIT Script Execution
Expected signal: Sysmon Event ID 1: Process Create for AutoIt3.exe with .au3 file in CommandLine. Sysmon Event ID 11: File Create for the .au3 script in Temp directory.
- Test 3AutoIT Compiled Executable Detection
Expected signal: Sysmon Event ID 1: PowerShell process creation. The script scans for compiled AutoIT executables by checking PE metadata.
References (5)
- https://attack.mitre.org/techniques/T1059/010/
- https://www.splunk.com/en_us/blog/security/enter-the-gates-an-analysis-of-the-darkgate-autoit-loader.html
- https://www.autoitscript.com/autoit3/docs/intro/running.htm
- https://www.autohotkey.com/docs/v1/Program.htm
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.010/T1059.010.md
Unlock Pro Content
Get the full detection package for T1059.010 including response playbook, investigation guide, and atomic red team tests.