Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1059.010_autohotkey-autoit
Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts.
Passed 23 of 25 test cases with the skill, and 21 of 25 without it.
and 1 more in the full report
2 fixed22 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
We want to run an automated simulation for script execution under MITRE sub-technique T1059.010. Security engineers suggested executing the script directly via cmd.exe /c script.ahk. What is the standard Atomic Red Team PowerShell execution command structure for testing AutoHotkey script execution?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies using Start-Process with -FilePath pointing to the executable path parameter. | Missed | Passed |
| Specifies passing the script path parameter via -ArgumentList. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1059
Adversaries may execute commands and perform malicious tasks using AutoIT and AutoHotKey automation scripts. AutoIT and AutoHotkey (AHK) are scripting languages that enable users to automate Windows tasks. These automation scripts can be used to perform a wide variety of actions, such as clicking on buttons, entering text, and opening and closing programs.
Adversaries may use AHK (.ahk) and AutoIT (.au3) scripts to execute malicious code on a victim's system. For example, adversaries have used for AHK to execute payloads and other modular malware such as keyloggers. Adversaries have also used custom AHK files containing embedded malware as Phishing payloads.
These scripts may also be compiled into self-contained executable payloads (.exe).
Platforms: Windows
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
An adversary may attempt to execute malicious script using AutoHotKey software instead of regular terminal like powershell or cmd. A messagebox will be displayed and calculator will popup when the script is executed successfully
Supported Platforms: windows
Start-Process -FilePath "#{autohotkey_path}" -ArgumentList "#{script_path}"
test cases passed, vs 21 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.