T1059.010 — AutoHotKey & AutoIT

Tactic: Execution · Platforms: Windows

Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking…

Sub-technique of Command and Scripting Interpreter (T1059).

Sigma detection rules (1)

T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT

title: "T1059.010 Command and Scripting Interpreter: AutoHotKey & AutoIT"
id: 859602f2-7ace-4cf4-9a8f-caca010d4fe9
description: 'Detection Strategy for AutoHotKey & AutoIT Abuse. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: TimeWindow, ParentProcessName, ScriptExtension, ChildProcessCount.'
references:
  - https://attack.mitre.org/techniques/T1059/010
author: Shahrukh Khan
date: 2026-06-07
license: MIT
tags:
  - attack.execution
  - attack.t1059.010

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection_ahk_image:
    Image|endswith:
      - '\AutoHotkey.exe'
      - '\AutoHotkeyU64.exe'
      - '\AutoHotkeyU32.exe'

  selection_ahk_script:
    CommandLine|contains: '.ahk'

  selection_autoit_image:
    Image|endswith:
      - '\AutoIt3.exe'
      - '\AutoIt3_x64.exe'

  selection_autoit_script:
    CommandLine|contains: '.au3'

  condition: 1 of selection_*

falsepositives:
  - Legitimate AutoHotkey or AutoIT usage by power users or IT automation in environments where either tool is sanctioned.

level: medium

Related sub-techniques

Explore