AutoIt - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/autoit/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 09 Jan 2024 18:45:00 +0000Renamed Automation Script Interpreter Detectionhttps://feed.craftedsignal.io/briefs/2024-01-renamed-autoit/Tue, 09 Jan 2024 18:45:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-renamed-autoit/This rule identifies renamed Automation Script Interpreter processes, often used by malware written in AutoIt/AutoHotKey to evade detection by renaming the executable.Attackers often rename legitimate utilities to masquerade their malicious activities and evade detection. This technique is particularly prevalent in malware leveraging scripting languages like AutoIt and AutoHotkey. These scripting tools, designed for automation, can be abused to create and execute malicious scripts. This detection identifies instances where the original filename of a process associated with AutoIt, AutoHotkey, or KIX32 does not match the actual process name, a strong indicator of masquerading. This activity is flagged by comparing the process.pe.original_file_name and process.name fields in process creation logs. The detection logic focuses on Windows systems, where these automation tools are commonly used. This matters for defenders because it can help to identify malware that is attempting to hide its true nature.

Attack Chain

  1. Attacker gains initial access to the system (e.g., via phishing or exploiting a vulnerability).
  2. Malicious AutoIt or AutoHotkey script is deployed to the system, often dropped in a user's profile directory or a temporary folder.
  3. The attacker renames the AutoIt or AutoHotkey interpreter executable (e.g., from AutoIt3.exe to svchost.exe).
  4. The renamed executable is then used to execute the malicious AutoIt/AutoHotkey script.
  5. The script performs actions such as downloading additional payloads, establishing persistence, or exfiltrating data.
  6. The script might modify registry keys or create scheduled tasks for persistence.
  7. The attacker leverages the script to perform lateral movement within the network.
  8. The final objective is achieved, such as data exfiltration or ransomware deployment.

Impact

A successful attack using a renamed scripting interpreter can lead to a wide range of consequences. Attackers can gain persistent access to the system, steal sensitive data, deploy ransomware, or use the compromised system as a foothold for further attacks within the network. Due to the script's ability to interact with the operating system, attackers can perform almost any action a legitimate user can. This can affect various sectors, leading to financial losses, reputational damage, and disruption of operations.

Recommendation

  • Deploy the Sigma rule "Renamed Automation Script Interpreter" to your SIEM to detect the specific masquerading behavior described in this brief.
  • Enable process creation logging with image load events (Sysmon or equivalent) to capture the process.pe.original_file_name and process.name attributes, which are critical for this detection.
  • Investigate any alerts generated by this rule, focusing on the process execution chain and any associated network connections or file modifications as outlined in the rule's "note" section.
  • Implement application control policies to restrict the execution of unauthorized executables in user profile directories and temporary folders.
  • Block execution of KIX32.EXE from user profile directories and ProgramData.
]]>highadvisorydefense-evasionexecutionmasqueradingwindows