DarkGate Loader Dropped in C:\Temp via AutoIT Script or autoit3.exe (Windows File Events)

title: DarkGate Loader Dropped in C:\Temp via AutoIT Script or autoit3.exe (Windows File Events)
id: 4d0b284a-998a-407a-bb27-cfccc3bb452e
status: test
description: This rule identifies attempts to place DarkGate-related artifacts in the C:\Temp directory by matching file names or paths associated with AutoIT script and execution components. Dropping and executing staged loader components from a temporary directory is a common attacker tactic to avoid scrutiny and quickly run payloads. Detection relies on Windows file event telemetry that includes the full filename/path and the originating image path.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
  - https://www.trendmicro.com/en_us/research/24/c/cve-2024-21412--darkgate-operators-exploit-microsoft-windows-sma.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/DarkGate/file_event_win_malware_darkgate_autoit3_save_temp.yml
author: Tomasz Dyduch, Josh Nickels, Huntrule Team
date: 2024-05-31
tags:
  - attack.execution
  - attack.t1059
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection_filename_suffix:
    TargetFilename|contains: :\temp\
    TargetFilename|endswith:
      - .au3
      - \autoit3.exe
  selection_image_suffix:
    Image|contains: :\temp\
    Image|endswith:
      - .au3
      - \autoit3.exe
  condition: 1 of selection_*
falsepositives:
  - Unlikely legitimate usage of AutoIT in temp folders.
level: medium
license: DRL-1.1
related:
  - id: df49c691-8026-48dd-94d3-4ba6a79102a8
    type: derived