Anvilogic medium experimental other

AutoIt Execution [snowflake-crowdstrikefdr_process]

AutoIt is a freeware scripting utility that can automate Windows GUI tasks such as mouse clicks, keystrokes, and window manipulations. While it is a legitimate tool, threat actors have abused it to automate malicious activity. This use case detects AutoIt, AutoIt2, or AutoIt3 executions, or commands loading .au3 files. -- Software Association: DarkGate

View Source

Detection Logic

select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and (regexp_like(process_path, '.*autoit(2
| 3)?\\\.exe.*', 'i') or regexp_like(process, '.*\\\S+\\\.exe.+\\\.au3.*', 'i'))

Field Validations

Loading…

Comments (0)

Loading comments...