Commonly abused AutoIT script drops an executable file to disk

Analytics BIOC Informational

Commonly abused AutoIT script drops an executable file to disk

AutoIT scripts have legitimate uses but are often abused by malware to execute in a signed process context.

Module:: Platform Analytics
Data source:: XDR Agent with eXtended Threat Hunting (XTH)

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Command and Scripting Interpreter: AutoHotKey & AutoIT (T1059.010) Command and Scripting Interpreter: Windows Command Shell (T1059.003)

Attacker's goals:

Gain code execution on the host and evade security controls.

Investigative actions:

Check whether the command line executed is benign or normal for the host and/or user performing it. Check whether the user from the command line is an administrator or other sensitive account.

Test period:: N/A (single event)
Deduplication:: 1 Day