{"id":"T1059.010","name":"AutoHotKey & AutoIT","url":"https://attack.mitre.org/techniques/T1059/010","tactics":["execution"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0332","stix_id":"x-mitre-detection-strategy--a948dd3c-a8f3-4bc0-aec3-4c5264e7a012","name":"Detection Strategy for AutoHotKey & AutoIT Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0332","analytics":[{"id":"AN0942","stix_id":"x-mitre-analytic--7975ae39-8c6b-45cc-9280-98e94b666c85","name":"Analytic 0942","description":"Detects execution of AutoHotKey or AutoIT interpreters or compiled scripts used for unauthorized automation, command execution, or payload delivery, correlated with anomalous process lineage, command-line arguments, or script creation events.","url":"https://attack.mitre.org/detectionstrategies/DET0332#AN0942","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Tuning this helps identify automation behavior outside expected user work hours."},{"field":"ParentProcessName","description":"Used to isolate cases where AHK or AutoIT scripts are spawned by suspicious or unusual processes."},{"field":"ScriptExtension","description":"Extensions such as .ahk, .au3, or unknown .exe names compiled from these."},{"field":"ChildProcessCount","description":"Threshold for number of spawned children to detect automation or modular malware behavior."}],"live":true,"detection_strategies":["DET0332"],"techniques":["T1059.010"]}],"live":true,"version":"1.0","techniques":["T1059.010"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}