huntrule

Suspicious AutoIt Interpreter Launched by Script Host or Shell

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-09-25
Updated
2026-09-25
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the AutoIt3 interpreter being launched by PowerShell or a command shell, a delivery pattern observed in Operation Poseidon where a ZIP to LNK to PowerShell chain executed AutoIt3.exe to load the EndRAT payload in memory. It captures abuse of the legitimate AutoIt engine to run compiled malicious scripts. Detecting this parentage is important because AutoIt3 spawned by a scripting host rather than a user-launched application is a common malware loader pattern.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Windows PowerShell Base64-encoded shellcode in ScriptBlockText
Suspicious PowerShell Spawned by WScript With Hidden Bypass via PureLogs Loader (via process_creation)
Suspicious PowerShell Execution of TrainedDataStore Script
Suspicious Salamander Named Pipe Creation
Suspicious Archive Expansion into Public User Directory via PowerShell (via ps_script)
Suspicious ClickFix PowerShell Download Cradle via TAG-150 Tradecraft
Malicious PowerShell Download of FortiEndpoint Patch Masquerade via EKZ Stealer
Suspicious Delayed Expansion Command Obfuscation Building PowerShell via Amatera Stealer
Suspicious PowerShell Host and Locale Reconnaissance via MuddyWater Tsundere Botnet
Suspicious AutoIt Interpreter Launched by Script Host or Shell
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.