www.autoitscript.com/site/autoit/

Hunt Hypothesis

This rule detects the execution of AutoIt scripts, a lightweight automation tool frequently abused by adversaries to perform initial access, credential dumping, or lateral movement without the need for complex PowerShell or WMI commands. Proactively hunting for this behavior in Azure Sentinel allows the SOC team to identify stealthy script-based intrusions that may bypass standard binary execution detections, particularly in environments where AutoIt is not a standard part of the development or operations toolchain.

YARA Rule

rule AutoIt
{
	meta:
		author = "_pusher_"
		date = "2016-07"
		description = "www.autoitscript.com/site/autoit/"
	strings:		
		$aa0 = "AutoIt has detected the stack has become corrupt.\n\nStack corruption typically occurs when either the wrong calling convention is used or when the function is called with the wrong number of arguments.\n\nAutoIt supports the __stdcall (WINAPI) and __cdecl calling conventions.  The __stdcall (WINAPI) convention is used by default but __cdecl can be used instead.  See the DllCall() documentation for details on changing the calling convention." wide ascii nocase
		$aa1 = "AutoIt Error" wide ascii nocase
		$aa2 = "Missing right bracket ')' in expression." wide ascii nocase
		$aa3 = "Missing operator in expression." wide ascii nocase
		$aa4 = "Unbalanced brackets in expression." wide ascii nocase
		$aa5 = "Error parsing function call." wide ascii nocase
	
		$aa6 = ">>>AUTOIT NO CMDEXECUTE<<<" wide ascii nocase
		$aa7 = "#requireadmin" wide ascii nocase
		$aa8 = "#OnAutoItStartRegister" wide ascii nocase
		$aa9 = "#notrayicon" wide ascii nocase
		$aa10 = "Cannot parse #include" wide ascii nocase
	condition:
		5 of ($aa*)
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 11 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Automation Scripts: Many older enterprise desktop applications or internal tools use AutoIt for GUI automation, data entry, or system maintenance tasks (e.g., automated logoff scripts, printer setup wizards, or legacy ERP client updates). These scripts often download the AutoIt interpreter or DLLs from the official site during initial deployment or version upgrades.
  • Filter/Exclusion: Exclude network connections to www.autoitscript.com if the source process is a known legacy application executable (e.g., LegacyApp.exe, ERPClient.exe) or if the destination port is 443 and the user agent contains “AutoIt” or “Mozilla” from a non-browser process.
• IT Provisioning and Imaging Tools: System administrators use AutoIt scripts within provisioning packages (e.g., SCCM, Intune custom scripts, or custom GPOs) to automate post-deployment tasks like joining domains, installing specific drivers, or configuring local policies. The AutoIt interpreter is often bundled in the provisioning image or downloaded during the “State” phase of deployment.
  • Filter/Exclusion: Exclude traffic from machines in the “Provisioning” or “Imaging” AD group, or exclude connections where the source process is a known deployment agent (e.g., CCMExec.exe, IntuneAgent.exe, wuauserv.exe) or if the source IP is within the designated build/imaging subnet.
• Test and Development Environments: Developers and QA engineers frequently use AutoIt for UI testing, regression testing, or rapid prototyping of internal tools. These environments often have looser network controls and may pull the latest AutoIt version directly from the website for testing purposes.
  • Filter/Exclusion: Exclude hosts tagged with “Dev”, “QA”, or “Test” in your CMDB or asset management system, or exclude connections from user accounts with