Signed AutoIT interpreter launched hidden with single dropped script arg

Ankit Mehta@Secvyn

•updated 25 days ago•0•0•3

Detects suspicious execution of files located in the AppData Local Temp directory initiated by PowerShell or using PowerShell-specific hidden window arguments. This behavior is commonly associated with dropper scripts or malware staging execution from a user's temporary folder.