AutoIt Execution (Sysmon)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

AutoIt is a freeware scripting utility that can automate Windows GUI tasks such as mouse clicks, keystrokes, and window manipulations. While it is a legitimate tool, threat actors have abused it to automate malicious activity. This use case detects AutoIt, AutoIt2, or AutoIt3 executions, or commands loading .au3 files

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

References

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

id: '23090.41775'
title: AutoIt Execution
description: 'AutoIt is a freeware scripting utility that can automate Windows GUI
  tasks such as mouse clicks, keystrokes, and window manipulations. While it is a
  legitimate tool, threat actors have abused it to automate malicious activity. This
  use case detects AutoIt, AutoIt2, or AutoIt3 executions, or commands loading .au3
  files. -- Software Association: DarkGate'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  "AutoIT3.exe" OR "AutoIT2.exe" OR "AutoIT.exe" OR ".au3" | regex process="(?i)\S+\.exe.+\.au3"
  | table _time, host, user, process, process_* | bin span=1s | stats values(*) as
  * by _time, host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- Windows Sysmon
references:
- https://isc.sans.edu/forums/diary/KPOT+Deployed+via+AutoIt+Script/25934/
- https://blog.talosintelligence.com/magnat-campaigns-use-malvertising-to/
- https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "AutoIT3.exe" OR "AutoIT2.exe" OR "AutoIT.exe" OR ".au3"

Stage 2: `regex`

| regex process="(?i)\S+\.exe.+\.au3"

Stage 3: `table`

| table _time, host, user, process, process_*

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`1` corpus 241 (splunk 225, kusto 15, elastic 1)	`field:"EventID" kind:eq value:"1"`
`process`	regex_match	`"(?i)\S+.exe.+.au3"` corpus 3 (splunk 3)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>1<"`
1	`"AutoIT3.exe"`
1	`"AutoIT2.exe"`
1	`"AutoIT.exe"`
1	`".au3"`