MITRE ATT&CKsub-technique

T1059.010 AutoHotKey & AutoIT

Published 2024-03-29 Modified 2025-04-15 Official page ↗
Domain
enterprise
Tactics
Execution
Platforms
Windows
Version
1.1
Created
2024-03-29

Description

Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs. Adversaries may use AHK (`.ahk`) and AutoIT (`.au3`) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as Phishing payloads. These scripts may also be compiled into self-contained executable payloads (`.exe`).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1059 Command and Scripting Interpreter technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M1038 Execution Prevention mitigation

Referenced by MITRE ATT&CK · uses (6)

  • S1213 Lumma Stealer software (malware)
  • S1207 XLoader software (malware)
  • S1111 DarkGate software (malware)
  • S1017 OutSteel software (malware)
  • S0530 Melcoz software (malware)
  • G0087 APT39 group

Referenced by Compliance · mitigates (12)

  • CIS-2.5 Allowlist Authorized Software CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-7 Least Functionality NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References