HUNT AutoIt to Inject AsyncRAT Into Microsoft-Signed Windows Process

Ankit Mehta@Secvyn

•updated 25 days ago•0•0•1

This rule monitors for indicators of compromise (IOCs) associated with a specific AutoIT-based malware delivery chain. It tracks the execution and presence of specific malicious file names and SHA256 hashes, as well as network connections to a identified command-and-control (C2) infrastructure IP address (158.51.122.136). The detection spans file creation, process execution, image loading, and network communication events to identify the multi-stage attack lifecycle.