Anvilogic medium experimental other

AutoHotkey Execution [snowflake-crowdstrikefdr_process]

Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs. This use case detects the usage of the AutoHotkey software to execute ahk files.

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and regexp_like(process_path, '.*AutoHotkey.+?\\\.(exe
| rc).*', 'i') and regexp_like(process, '.*\\\.ahk.*', 'i')

Field Validations

Loading…

Comments (0)

Loading comments...