DarkGate Loader Dropped in C:\Temp via AutoIT Script or autoit3.exe (Windows File Events)
Flags Windows file activity in C:\temp for DarkGate loader staging using .au3 and autoit3.exe artifacts.
- Product
- windows
- Category
- file_event
- Author
- Tomasz Dyduch, Josh Nickels (SigmaHQ), DRL 1.1
- Published
- 2024-05-31
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies attempts to place DarkGate-related artifacts in the C:\Temp directory by matching file names or paths associated with AutoIT script and execution components. Dropping and executing staged loader components from a temporary directory is a common attacker tactic to avoid scrutiny and quickly run payloads. Detection relies on Windows file event telemetry that includes the full filename/path and the originating image path.
Reporting behind it
- bleepingcomputer.comhttps://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
- trendmicro.comhttps://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_save_temp.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: DarkGate Loader Dropped in C:\Temp via AutoIT Script or autoit3.exe (Windows File Events)
id: 4d0b284a-998a-407a-bb27-cfccc3bb452e
status: test
description: This rule identifies attempts to place DarkGate-related artifacts in the C:\Temp directory by matching file names or paths associated with AutoIT script and execution components. Dropping and executing staged loader components from a temporary directory is a common attacker tactic to avoid scrutiny and quickly run payloads. Detection relies on Windows file event telemetry that includes the full filename/path and the originating image path.
references:
- https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
- https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_save_temp.yml
author: Tomasz Dyduch, Josh Nickels, Huntrule Team
date: 2024-05-31
tags:
- attack.execution
- attack.t1059
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection_filename_suffix:
TargetFilename|contains: :\temp\
TargetFilename|endswith:
- .au3
- \autoit3.exe
selection_image_suffix:
Image|contains: :\temp\
Image|endswith:
- .au3
- \autoit3.exe
condition: 1 of selection_*
falsepositives:
- Unlikely legitimate usage of AutoIT in temp folders.
level: medium
license: DRL-1.1
related:
- id: df49c691-8026-48dd-94d3-4ba6a79102a8
type: derived