AutoIt Script Execution Detection

F S@Fsdr

•updated Jun 16, 2026•3•0•10

This rule detects the execution of processes where the original file name contains 'autoit' but the current file name does not, which can indicate obfuscation or malicious use of AutoIt scripts.