Windows Autoit3.exe Created by Uncommon Process (curl.exe/KeyScramblerLogon.exe/etc.)
Alerts on Windows events where Autoit3.exe is created, with the producing process matching curl.exe or other uncommon executables.
- Product
- windows
- Category
- file_event
- Author
- Micah Babinski (SigmaHQ), DRL 1.1
- Published
- 2023-10-15
- Updated
- 2026-07-31
ATT&CK techniques
Execution → C2Recon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags file creation where Autoit3.exe is created as a target by unusual parent/tool processes such as curl.exe, KeyScramblerLogon.exe, ExtExport.exe, or wmprph.exe. Creating Autoit3.exe via non-standard utilities is a common tactic to stage execution using a scripting/automation binary and evade normal application startup paths. It relies on Windows file event telemetry that records the creating process image and the created target filename, matching on the relevant executable names and ends-with paths.
Reporting behind it
- github.security.telekom.comhttps://github.security.telekom.com/2023/08/darkgate-loader.html
- kroll.comhttps://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
- github.comhttps://github.com/pr0xylife/DarkGate/tree/main
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_binary_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Autoit3.exe Created by Uncommon Process (curl.exe/KeyScramblerLogon.exe/etc.)
id: 4ce47442-f3f3-48d1-ab40-5e90fda879a7
status: test
description: This rule flags file creation where Autoit3.exe is created as a target by unusual parent/tool processes such as curl.exe, KeyScramblerLogon.exe, ExtExport.exe, or wmprph.exe. Creating Autoit3.exe via non-standard utilities is a common tactic to stage execution using a scripting/automation binary and evade normal application startup paths. It relies on Windows file event telemetry that records the creating process image and the created target filename, matching on the relevant executable names and ends-with paths.
references:
- https://github.security.telekom.com/2023/08/darkgate-loader.html
- https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
- https://github.com/pr0xylife/DarkGate/tree/main
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_binary_creation.yml
author: Micah Babinski, Huntrule Team
date: 2023-10-15
tags:
- attack.command-and-control
- attack.execution
- attack.t1105
- attack.t1059
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \Autoit3.exe
- \curl.exe
- \ExtExport.exe
- \KeyScramblerLogon.exe
- \wmprph.exe
TargetFilename|endswith: \Autoit3.exe
condition: selection
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 1a433e1d-03d2-47a6-8063-ece992cf4e73
type: derived