Windows AutoIt3.exe Execution With Suspicious Parent Process

title: Windows AutoIt3.exe Execution With Suspicious Parent Process
id: 8dc8baf1-69b3-4aae-bdbc-c3d2a9f4642f
status: test
description: This rule flags process creation where AutoIt3.exe is launched and the parent process is a suspicious executable (cmd.exe, KeyScramblerLogon.exe, or msiexec.exe). Attackers often use AutoIt3.exe to run arbitrary code in the context of a spawned Windows process, making parent-child relationships important for identifying abuse. The detection relies on Windows process creation telemetry, matching the AutoIt3.exe image/original filename and the parent image path.
references:
  - https://github.security.telekom.com/2023/08/darkgate-loader.html
  - https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
  - https://github.com/pr0xylife/DarkGate/tree/main
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_autoit3_from_susp_parent_and_location.yml
author: Micah Babinski, Huntrule Team
date: 2023-10-15
tags:
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_proc:
    - Image|endswith: \Autoit3.exe
    - OriginalFileName: AutoIt3.exe
  selection_parent:
    ParentImage|endswith:
      - \cmd.exe
      - \KeyScramblerLogon.exe
      - \msiexec.exe
  filter_main_legit_autoit_location:
    Image|endswith:
      - :\Program Files (x86)\AutoIt3\AutoIt3.exe
      - :\Program Files\AutoIt3\AutoIt3.exe
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: f8e9aa1c-14f2-4dbd-aa59-b98968ed650d
    type: derived