AutoHotKey & AutoIT
Subtechnique · ATTACK:enterprise:T1059.010
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1059.010",
"title": "AutoHotKey & AutoIT",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1059/010",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--3a32740a-11b0-4bcf-b0a9-3abd0f6d3cd5",
"external_id": "T1059.010",
"domain": "enterprise",
"created": "2024-03-29T18:07:04.743Z",
"modified": "2025-04-15T19:58:23.600Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"execution"
],
"source_references": [
{
"source_name": "AutoHotKey",
"url": "https://www.autohotkey.com/docs/v1/Program.htm"
},
{
"source_name": "AutoIT",
"url": "https://www.autoitscript.com/autoit3/docs/intro/running.htm"
},
{
"source_name": "Splunk DarkGate",
"url": "https://www.splunk.com/en_us/blog/security/enter-the-gates-an-analysis-of-the-darkgate-autoit-loader.html"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1213 → uses → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02eeb90c-c76a-4009-8319-d8d286efa06c
Cybereason LumaStealer Undated · Qualys LummaStealer 2024ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09082234-c658-45c4-9cd0-d4984b6bdf85
ATTACK:enterprise:S0530 → uses → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2a9d9c0a-1c8b-4f80-bdd2-9ba8394cb625
Securelist Brazilian Banking Malware July 2020ATTACK:enterprise:S1207 → uses → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54800108-45e1-4e5d-9aaa-0374cf448367
Google XLoader 2017ATTACK:enterprise:S1017 → uses → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68f9103d-e772-493b-9ce6-fde4e2473207
Palo Alto Unit 42 OutSteel SaintBot February 2022ATTACK:enterprise:T1059.010 → subtechnique-of → ATTACK:enterprise:T1059
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6a2d3362-53f6-455b-bc1f-be9b85706a47
ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b9c3bc4-8805-4074-9a0c-ef3d4c69656c
FBI FLASH APT39 September 2020ATTACK:enterprise:S1111 → uses → ATTACK:enterprise:T1059.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7ccb8be7-7929-4186-8da6-48889be34952
Ensilo Darkgate 2018