Disguised AutoHotkey from WindowsSoundDiagnostics
Detects AutoHotkey (AHK) scripts executing from the 'Microsoft.WindowsSoundDiagnostics' directory, which is an unusual location for such scripts and has been observed as a staging directory for malware like AsyncRAT. This rule specifically looks for process events where the initiating process or the process itself is located in 'Microsoft.WindowsSoundDiagnostics' and the command line contains '.ahk'.
Microsoft Sentinel (KQL)
