kevmap

TechniquesT1059.010 › AN0942

AN0942 Analytic 0942

Windows · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Detects execution of AutoHotKey or AutoIT interpreters or compiled scripts used for unauthorized automation, command execution, or payload delivery, correlated with anomalous process lineage, command-line arguments, or script creation events.</p>
Detects
T1059.010 AutoHotKey & AutoIT
Part of
DET0332 Detection Strategy for AutoHotKey & AutoIT Abuse

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log sourceChannelData component
WinEventLog:SysmonEventCode=1DC0032 Process Creation
WinEventLog:SysmonEventCode=11DC0039 File Creation
WinEventLog:SysmonEventCode=10DC0035 Process Access

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

FieldDescription
TimeWindowTuning this helps identify automation behavior outside expected user work hours.
ParentProcessNameUsed to isolate cases where AHK or AutoIT scripts are spawned by suspicious or unusual processes.
ScriptExtensionExtensions such as .ahk, .au3, or unknown .exe names compiled from these.
ChildProcessCountThreshold for number of spawned children to detect automation or modular malware behavior.