Casbaneiro: AutoIt Interpreter Spawned by mshta.exe Running Compiled AU3 Script

Arnold Chan@slaz

•updated 22 days ago•0•0•1

Detects the execution of AutoIt3 scripts using mshta.exe as the parent process from suspicious or non-standard directories such as Temp, Downloads, or AppData. This behavior is indicative of an attempt to bypass application execution policies or obfuscate malicious script execution.