AutoHotKey and AutoIT abuse (MITRE ATT&CK T1059.010) is an Execution technique on Windows.
AutoIT and AutoHotkey (AHK) are scripting languages for automating Windows tasks. They can click buttons, type text, and open or close programs. That makes them handy for office automation, and for anyone who wants a quiet way to run actions on a desktop.
How attackers use it
MITRE says adversaries use AHK (.ahk) and AutoIT (.au3) scripts to execute malicious code. Examples include running payloads and modular malware such as keyloggers, and sending custom AHK files with embedded malware as phishing payloads. These scripts may also be compiled into self-contained executables (.exe), so you may not see a script file at all.
How to detect it
MITRE's detection strategy looks for the AutoHotKey or AutoIT interpreters, or compiled scripts, used for unauthorized automation, command execution or payload delivery. It asks you to correlate that with unusual process lineage, odd command line arguments, and script creation events.
Collect process creation logs with parent and command line, and file creation events for .ahk and .au3 files in user folders.
How to reduce the risk
MITRE lists one mitigation, Execution Prevention. Use application control to prevent execution of AutoIt3.exe, AutoHotkey.exe and other related features that are not required on a given system or network.
If a team does use these tools, allow them for that team only and alert on use elsewhere.
Quick check
Why might a compiled AutoIT payload not show a script file?
Scripts can be compiled into self-contained executables, so only an .exe lands on disk.
