Potential AutoHotkey .ahk Execution (PowerShell)

Group by: _time, host
Source: github.com/anvilogic-forge/armory

Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs. This use case detects exeuction of .ahk files, accounting for renamed AutoHotkey binaries. Due to the broad nature of this rule, false positives for .ahk creation are expected. Allowlisting for expected executables and command line arguments is recommended.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059` Command and Scripting Interpreter

References

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4103: Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

id: '32266.57398'
title: Potential AutoHotkey .ahk Execution
description: Adversaries may execute commands and perform malicious tasks using AutoIT
  and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages
  that enable users to automate Windows tasks. These automation scripts can be used
  to perform a wide variety of actions, such as clicking on buttons, entering text,
  and opening and closing programs. This use case detects exeuction of .ahk files,
  accounting for renamed AutoHotkey binaries. Due to the broad nature of this rule,
  false positives for .ahk creation are expected. Allowlisting for expected executables
  and command line arguments is recommended.
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR
  "<EventID>4103<") OR (TERM(EventCode=4104) OR "<EventID>4104<") ".ahk" | regex process="(?i)\.exe.+\S+\.ahk(\s|$|\")"
  | table _time, host, user, process | bin span=1s | stats values(*) as * by _time,
  host '
techniques:
- execution:command and scripting interpreter
technique_id: 
- T1059
data_category:
- PowerShell logs
references:
- https://attack.mitre.org/techniques/T1059/010/
- https://detection.fyi/sigmahq/sigma/windows/process_creation/proc_creation_win_renamed_autohotkey/
- https://www.autohotkey.com/

Stages and Predicates

Stage 1: `search`

`get_endpoint_data` `get_endpoint_data_powershell` (TERM(EventCode=4103) OR "<EventID>4103<") OR (TERM(EventCode=4104) OR "<EventID>4104<") ".ahk"

Stage 2: `regex`

| regex process="(?i)\.exe.+\S+\.ahk(\s|$|\")"

Stage 3: `table`

| table _time, host, user, process

Stage 4: `bucket`

| bin span=1s

Stage 5: `stats`

| stats values(*) as * by _time, host

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`EventCode`	eq	`4103` corpus 105 (splunk 105) `4104` corpus 269 (splunk 269)	`field:"EventID" kind:eq`
`process`	regex_match	`"(?i).exe.+\S+.ahk(\s\|$\|\")"` corpus 3 (splunk 3)	`field:"CommandLine" kind:regex_match`

Search terms

These SPL tokens match against raw event text.

Stage	Term
1	`"<EventID>4103<"`
1	`"<EventID>4104<"`
1	`".ahk"`