Windows File Creation of Autoit3.exe by curl.exe or other uncommon parent processes

title: Windows File Creation of Autoit3.exe by curl.exe or other uncommon parent processes
id: 4ce47442-f3f3-48d1-ab40-5e90fda879a7
status: test
description: This rule flags file creation events where Autoit3.exe is created as a target, triggered by curl.exe or other uncommon/suspicious executables (e.g., ExtExport.exe, KeyScramblerLogon.exe, wmprph.exe). Creating or staging Autoit3.exe from non-standard processes is a common indicator of malicious tooling deployment and execution staging. The detection relies on Windows file event telemetry that includes both the creating process image and the target filename for the created Autoit3.exe.
references:
  - https://github.security.telekom.com/2023/08/darkgate-loader.html
  - https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
  - https://github.com/pr0xylife/DarkGate/tree/main
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_binary_creation.yml
author: Micah Babinski, Huntrule Team
date: 2023-10-15
tags:
  - attack.command-and-control
  - attack.execution
  - attack.t1105
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
      - \Autoit3.exe
      - \curl.exe
      - \ExtExport.exe
      - \KeyScramblerLogon.exe
      - \wmprph.exe
    TargetFilename|endswith: \Autoit3.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1a433e1d-03d2-47a6-8063-ece992cf4e73
    type: derived