Command and Scripting Interpreter: AutoHotKey & AutoIT
- ID
- T1059.010
- Tactics
- TA0002 Execution
- Sub-technique of
- T1059 Command and Scripting Interpreter
- Platforms
- Windows
- Data sources
- Process Creation, File Creation, Process Access
- Source
- attack.mitre.org
- MITRE last modified
- 16 Apr 2025
Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.[1][2]
Adversaries may use AHK (.ahk) and AutoIT (.au3) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as Phishing payloads.[3]
These scripts may also be compiled into self-contained executable payloads (.exe).[1][2]
Detection
- DET0332 Detection Strategy for AutoHotKey & AutoIT Abuse
Data components: Process Creation, File Creation, Process Access
Mitigations (1)
- M1038 Execution Prevention
Use application control to prevent execution of
AutoIt3.exe,AutoHotkey.exe, and other related features that may not be required for a given system or network to prevent potential misuse by adversaries.