splApache-2.0from splunk/security_content

Windows AutoIt3 Execution

The following analytic detects the execution of AutoIt3, a scripting language often used for automating Windows GUI tasks and general scripting. It identifies instances where AutoIt3 or its variants are executed by searching for process names or original file names matching 'autoit3.exe'. This activity is significant because attackers frequently use AutoIt3 to automate malicious actions, such as executing malware. If confirmed malicious, this activity could lead to unauthorized code execution, system compromise, or further propagation of malware within the environment.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/windows_autoit3_execution.yml

| tstats `security_content_summariesonly`
  count min(_time) as firstTime
  max(_time) as lastTime
from datamodel=Endpoint.Processes where
(
  Processes.process_name = "autoit*.exe"
  OR
  Processes.original_file_name = "autoit*.exe"
)
by Processes.action Processes.dest Processes.original_file_name
   Processes.parent_process Processes.parent_process_exec
   Processes.parent_process_guid Processes.parent_process_id
   Processes.parent_process_name Processes.parent_process_path
   Processes.process Processes.process_exec Processes.process_guid
   Processes.process_hash Processes.process_id Processes.process_integrity_level
   Processes.process_name Processes.process_path Processes.user
   Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_autoit3_execution_filter`