AutoIt or AutoHotkey binary executing under a different file name

Siemphony@siemphonymediumT1059.010unverifiedPlaybook · Unexpected execution

Matches Sysmon EventID 1's `OriginalFileName`, PE version-resource metadata the compiler embeds and a rename cannot remove, against the AutoIt/AutoHotkey interpreter names — the direct answer to AN0942's own ScriptExtension knob, which flags "unknown .exe names compiled from these": once a `.ahk`/`.au3` script is compiled to a standalone executable the extension is gone, so matching on `Image` or `CommandLine` for those scripts would miss exactly the compiled case MITRE names. This selector needs no companion field to be meaningful and stays true whether the interpreter kept its own name or was renamed to blend in. MITRE's other tuning knobs — ParentProcessName, TimeWindow, ChildProcessCount — are left for a site to add; none is incorporated here. A determined adversary can still strip or forge the version-resource block before compiling, which removes the one field this rule relies on. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0332, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: AutoIt or AutoHotkey binary executing under a different file name2id: 4340c739-27e0-4327-af00-adc41efe9a6e3status: experimental4description: |5  Matches Sysmon EventID 1's `OriginalFileName`, PE version-resource metadata6  the compiler embeds and a rename cannot remove, against the AutoIt/AutoHotkey7  interpreter names — the direct answer to AN0942's own ScriptExtension knob,8  which flags "unknown .exe names compiled from these": once a `.ahk`/`.au3`9  script is compiled to a standalone executable the extension is gone, so10  matching on `Image` or `CommandLine` for those scripts would miss exactly the11  compiled case MITRE names. This selector needs no companion field to be12  meaningful and stays true whether the interpreter kept its own name or was13  renamed to blend in. MITRE's other tuning knobs — ParentProcessName,14  TimeWindow, ChildProcessCount — are left for a site to add; none is15  incorporated here. A determined adversary can still strip or forge the16  version-resource block before compiling, which removes the one field this17  rule relies on.18  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0332, not hand-written and not tested by its author. Any lab result is on this rule's own page.19references:20  - https://attack.mitre.org/techniques/T1059/01021  - https://attack.mitre.org/detectionstrategies/DET033222author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)23date: 2026-08-1624tags:25  - attack.execution26  - attack.t1059.01027logsource:28  category: process_creation29  product: windows30detection:31  selection:32    OriginalFileName:33      - 'AutoIt3.exe'34      - 'AutoIt.exe'35      - 'AutoHotkey.exe'36      - 'AutoHotkeyU32.exe'37      - 'AutoHotkeyU64.exe'38      - 'AutoHotkeyA32.exe'39  condition: selection40falsepositives:41  - "Legitimate business-process automation and RPA built on AutoIt or AutoHotkey — help-desk password-reset macros, kiosk automation, unattended-install wrappers — all carry the same OriginalFileName metadata as malicious use and are indistinguishable from it on this field alone."42  - "Third-party installers and updaters that embed an AutoIt3.exe-compiled component as their own installer engine; several commercial Windows applications ship this way, so the vendor's executable name differs but the original AutoIt3.exe metadata survives."43level: medium

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (ProcessVersionInfoOriginalFileName =~ "AutoIt3.exe" or ProcessVersionInfoOriginalFileName =~ "AutoIt.exe" or ProcessVersionInfoOriginalFileName =~ "AutoHotkey.exe" or ProcessVersionInfoOriginalFileName =~ "AutoHotkeyU32.exe" or ProcessVersionInfoOriginalFileName =~ "AutoHotkeyU64.exe" or ProcessVersionInfoOriginalFileName =~ "AutoHotkeyA32.exe")

Splunk · SPL

Run this as a search.

index=* (OriginalFileName="AutoIt3.exe" OR OriginalFileName="AutoIt.exe" OR OriginalFileName="AutoHotkey.exe" OR OriginalFileName="AutoHotkeyU32.exe" OR OriginalFileName="AutoHotkeyU64.exe" OR OriginalFileName="AutoHotkeyA32.exe")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (TO_LOWER(process.pe.original_file_name) == "autoit3.exe" OR TO_LOWER(process.pe.original_file_name) == "autoit.exe" OR TO_LOWER(process.pe.original_file_name) == "autohotkey.exe" OR TO_LOWER(process.pe.original_file_name) == "autohotkeyu32.exe" OR TO_LOWER(process.pe.original_file_name) == "autohotkeyu64.exe" OR TO_LOWER(process.pe.original_file_name) == "autohotkeya32.exe")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="OriginalFileName" type="pcre2">(?i)(^AutoIt3\.exe$|^AutoIt\.exe$|^AutoHotkey\.exe$|^AutoHotkeyU32\.exe$|^AutoHotkeyU64\.exe$|^AutoHotkeyA32\.exe$)</field>    <description>AutoIt or AutoHotkey binary executing under a different file name</description>    <mitre>      <id>T1059.010</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: script_interpreter_execution
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 4340c739-27e0-4327-af00-adc41efe9a6e

ATT&CKT1059.010

T1059.010AutoHotKey & AutoIT

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1059.010, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 2 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's DET0332 names four tuning knobs in mutableElements: TimeWindow, ParentProcessName, ScriptExtension, and ChildProcessCount. This rule implements none of them as fields — the six-value OriginalFileName list is this rule author's own answer to the ScriptExtension knob's "unknown .exe names compiled from these" case, not a value list MITRE supplied. TimeWindow, ParentProcessName, and ChildProcessCount are left for a site to add on top: pair this selector with a known automation host's parent process, or feed it into whatever aggregation logic your SIEM supports. Review flagged one concrete gap in the value list itself: the legacy AutoIt2.exe interpreter name, which SigmaHQ's own published renamed-AutoIt rule checks and this one omits — add it for parity with older AutoIt installs. The rule's own description also discloses the strongest true evasion: strip or forge the PE version-resource block before compiling, and the one field this rule depends on disappears entirely.

Declared by the author

Legitimate business-process automation and RPA built on AutoIt or AutoHotkey — help-desk password-reset macros, kiosk automation, unattended-install wrappers — all carry the same OriginalFileName metadata as malicious use and are indistinguishable from it on this field alone.
Third-party installers and updaters that embed an AutoIt3.exe-compiled component as their own installer engine; several commercial Windows applications ship this way, so the vendor's executable name differs but the original AutoIt3.exe metadata survives.

Lessonscript interpreter execution

script interpreter executionAI draft — unreviewed

01 · What this rule detects

This rule catches an AutoIt or AutoHotkey interpreter running under any file name, by keying on the PE version-resource metadata (OriginalFileName) that the compiler embeds and a rename cannot strip. It flags six exact values in Sysmon EventID 1's OriginalFileName field: AutoIt3.exe, AutoIt.exe, AutoHotkey.exe, AutoHotkeyU32.exe, AutoHotkeyU64.exe, AutoHotkeyA32.exe. This is analytic AN0942 under MITRE's DET0332, whose own description names the interesting case explicitly: "unknown .exe names compiled from these" — a .ahk or .au3 script compiled into a standalone binary and then renamed to blend in. That is a targeted answer to a real evasion, not a bulk keyword search for "autohotkey" across logs.

02 · Telemetry you need

Sysmon EventID 1, process_creation category, windows product — the logsource copied verbatim from the brief's first analytics[].logSources[] entry. You need Sysmon deployed with a configuration that still captures OriginalFileName, which the default config does as long as the process-creation rule isn't excluded. The brief actually lists three log sources for AN0942 — EventID 1 (process creation), EventID 11 (file creation), EventID 10 (process access) — but this rule uses only EventID 1. Catching the .ahk/.au3 script file landing on disk, or a compiled AutoIt binary reaching into another process's memory, would need separate rules against the other two sources; nothing here covers them.

03 · How the logic works

There is one selection block and condition: selection — no 1 of/all of, no negation, just one field matched against a list of six literal strings. OriginalFileName is the interpreter's compiled-in identity, independent of Image or CommandLine. That is the whole point: rename the binary to svchost32.exe and launch it under that name, and Image/CommandLine show the fake name while OriginalFileName still reads AutoIt3.exe. This is precursor-only Sigma — no time window, no child-process counting, no cross-event correlation. AN0942's own description talks about correlating "with anomalous process lineage, command-line arguments, or script creation events," but lib/sigma in this corpus cannot express aggregation or multi-event correlation, so what you actually get is the single-event trigger, not the fuller analytic MITRE described.

04 · Common false positives

Two honest false positives are listed, and both matter because OriginalFileName cannot distinguish intent from identity. First: legitimate RPA and help-desk automation — password-reset macros, kiosk automation, unattended-install wrappers — built on AutoIt or AutoHotkey carries the same metadata as malicious use. Second: third-party installers that embed an AutoIt3.exe-compiled component as their installer engine; the vendor's visible executable name differs, but the embedded AutoIt3.exe metadata survives untouched. level: medium reflects that neither false positive dominates by a wide margin, but neither is rare.

05 · Detection maturity

tier_1: UNVERIFIED — the lowest tier in this corpus. This rule has never been run against a single log line; it is a scaffold derived from MITRE's analytic description, not a validated detection. No false-positive rate, hit count, or performance figure exists for it, and none should be assumed until it is actually deployed against real telemetry.

Related detections1 nearby

Utility executing under a name its own PE metadata contradicts

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/4340c739-27e0-4327-af00-adc41efe9a6e

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

AutoIt or AutoHotkey binary executing under a different file name

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it