Windows File Events: DarkGate Loader Drop and Execute via C:\Temp AutoIt Artifacts

Flags Windows file activity in C:\temp for DarkGate loader staging using .au3 and autoit3.exe artifacts.

FreeUnreviewedSigmamediumv1

windows-file-events-darkgate-loader-drop-and-execute-via-c-temp-autoit-artifacts-df49c691

title: "Windows File Events: DarkGate Loader Drop and Execute via C:\\Temp AutoIt Artifacts"
id: 4d0b284a-998a-407a-bb27-cfccc3bb452e
status: test
description: This rule identifies file creation activity in the C:\temp directory associated with DarkGate loader staging using AutoIt-related artifacts. Attackers often drop and run payload components from temporary locations to reduce friction for execution and cleanup. The detection relies on Windows file event telemetry matching paths in the target filename and image fields that end with .au3 or \autoit3.exe within \temp.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
  - https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_save_temp.yml
author: Tomasz Dyduch, Josh Nickels, Huntrule Team
date: 2024-05-31
tags:
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_filename_suffix:
    TargetFilename|contains: :\temp\
    TargetFilename|endswith:
      - .au3
      - \autoit3.exe
  selection_image_suffix:
    Image|contains: :\temp\
    Image|endswith:
      - .au3
      - \autoit3.exe
  condition: 1 of selection_*
falsepositives:
  - Unlikely legitimate usage of AutoIT in temp folders.
level: medium
license: DRL-1.1
related:
  - id: df49c691-8026-48dd-94d3-4ba6a79102a8
    type: derived

What it detects

This rule identifies file creation activity in the C:\temp directory associated with DarkGate loader staging using AutoIt-related artifacts. Attackers often drop and run payload components from temporary locations to reduce friction for execution and cleanup. The detection relies on Windows file event telemetry matching paths in the target filename and image fields that end with .au3 or \autoit3.exe within \temp.

Known false positives

Unlikely legitimate usage of AutoIT in temp folders.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.