tfMITRE ATT&CK sub-technique

AutoHotKey & AutoIT T1059.010

sub-technique of T1059 Command and Scripting Interpreter

Tactic: Execution
Platform: Windows
Version: 1.1
Created: 29 March 2024
Last modified: 15 April 2025
Contributors: TruKno; Liran Ravich, CardinalOps; Serhii Melnyk, Trustwave SpiderLabs; Rahmat Nurfauzi, @infosecn1nja, PT Xynexis International; @_montysecurity

Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

AutoHotKey & AutoIT MITRE reference T1059.010

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

APT39G0087 ↗

Has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.1

created 2019-02-191 referenceaka ITG07

All 1 groups for this technique

5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Lumma StealerS1213 ↗

Has utilized AutoIt malware scripts and AutoIt executables.1 2

created 2025-03-22MALWARE

XLoaderS1207 ↗

Can use an AutoIT script to decrypt a payload file, load it into victim memory, then execute it on the victim machine.1

created 2025-03-11MALWARE

DarkGateS1111 ↗

Uses AutoIt scripts dropped to a hidden directory during initial installation phases, such as test.au3.1

created 2024-02-09MALWARE

OutSteelS1017 ↗

Was developed using the AutoIT scripting language.1

created 2022-06-09MALWAREcarried by 1 group

MelcozS0530 ↗

Has been distributed through an AutoIt loader script.1

created 2020-11-10MALWARE

All 5 software entries for this technique

Offense vs defense T1059.010

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

AutoHotKey & AutoIT detection strategy DET0332

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for AutoHotKey & AutoIT Abuse

Enterprise

1 platform

AN0942 · Windows

Detects execution of AutoHotKey or AutoIT interpreters or compiled scripts used for unauthorized automation, command execution, or payload delivery, correlated with anomalous process lineage, command-line arguments, or script creation events.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Process AccessDC0035	WinEventLog:Sysmon	EventCode=10
File CreationDC0039	WinEventLog:Sysmon	EventCode=11

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Tuning this helps identify automation behavior outside expected user work hours.
ParentProcessName	Used to isolate cases where AHK or AutoIT scripts are spawned by suspicious or unusual processes.
ScriptExtension	Extensions such as .ahk, .au3, or unknown .exe names compiled from these.
ChildProcessCount	Threshold for number of spawned children to detect automation or modular malware behavior.

Execution PreventionM1038

Use application control to prevent execution of AutoIt3.exe, AutoHotkey.exe, and other related features that may not be required for a given system or network to prevent potential misuse by adversaries.

Tests1ExecutorsPowerShell 1Need elevation0 of 1Have prerequisites1Have cleanup0Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

AutoHotKey script execution

windows

PowerShell

—

An adversary may attempt to execute malicious script using AutoHotKey software instead of regular terminal like powershell or cmd. A messagebox will be displayed and calculator will popup when the script is executed successfully

Input arguments

Name	Type	Default	Description
script_path	path	PathToAtomicsFolder\T1059.010\src\calc.ahk	AutoHotKey Script Path
autohotkey_path	path	$PathToAtomicsFolder\..\ExternalPayloads\ahk\AutoHotKeyU64.exe	AutoHotKey Executable File Path

Attack command

Start-Process -FilePath "#{autohotkey_path}" -ArgumentList "#{script_path}"

Prerequisite

AutoHotKey executable file must exist on disk at the specified location (#{autohotkey_path})

Check

if(Test-Path "#{autohotkey_path}") {
    exit 0
} else {
    exit 1
}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
$AutoHotKeyURL = "https://www.autohotkey.com/download/ahk.zip"
$InstallerPath = "$PathToAtomicsFolder\..\ExternalPayloads"
Invoke-WebRequest -Uri $AutoHotKeyURL -OutFile $InstallerPath\ahk.zip
Expand-Archive -Path $InstallerPath -Force;

GUID2cf03514-cef7-4902-9ba8-1f65092d3850

Tests from Atomic Red Team (MIT licence) · technique definition

AutoHotKey & AutoIT detections T1059.010

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs