DarkGate-related Autoit3.exe execution with suspicious parent process (Windows)
Alerts on AutoIt3.exe execution when spawned from cmd.exe, KeyScramblerLogon.exe, or msiexec.exe, excluding common legitimate install paths.
- Product
- windows
- Category
- process_creation
- Author
- Micah Babinski (SigmaHQ), DRL 1.1
- Published
- 2023-10-15
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags executions of Autoit3.exe where the binary is launched from specific suspicious parent processes, rather than common user-driven installers or shells. Attackers commonly use AutoIt’s legitimate runtime to run scripted payloads and perform follow-on actions such as process injection and outbound communications. It relies on Windows process creation telemetry including the executed image path, OriginalFileName, and parent image path.
Reporting behind it
- github.security.telekom.comhttps://github.security.telekom.com/2023/08/darkgate-loader.html
- kroll.comhttps://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
- github.comhttps://github.com/pr0xylife/DarkGate/tree/main
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_autoit3_from_susp_parent_and_location.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: DarkGate-related Autoit3.exe execution with suspicious parent process (Windows)
id: 8dc8baf1-69b3-4aae-bdbc-c3d2a9f4642f
status: test
description: This rule flags executions of Autoit3.exe where the binary is launched from specific suspicious parent processes, rather than common user-driven installers or shells. Attackers commonly use AutoIt’s legitimate runtime to run scripted payloads and perform follow-on actions such as process injection and outbound communications. It relies on Windows process creation telemetry including the executed image path, OriginalFileName, and parent image path.
references:
- https://github.security.telekom.com/2023/08/darkgate-loader.html
- https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
- https://github.com/pr0xylife/DarkGate/tree/main
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/DarkGate/proc_creation_win_malware_darkgate_autoit3_from_susp_parent_and_location.yml
author: Micah Babinski, Huntrule Team
date: 2023-10-15
tags:
- attack.execution
- attack.t1059
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_proc:
- Image|endswith: \Autoit3.exe
- OriginalFileName: AutoIt3.exe
selection_parent:
ParentImage|endswith:
- \cmd.exe
- \KeyScramblerLogon.exe
- \msiexec.exe
filter_main_legit_autoit_location:
Image|endswith:
- :\Program Files (x86)\AutoIt3\AutoIt3.exe
- :\Program Files\AutoIt3\AutoIt3.exe
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: f8e9aa1c-14f2-4dbd-aa59-b98968ed650d
type: derived