T1059.010 AutoHotKey & AutoIT

Activity timeline

T1059.010 first appeared in tracked threats on 2026-04-23 and was most recently reported on 2026-09-30. The busiest month was 2026-08 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1059.010 AutoHotKey & AutoIT is catalogued by MITRE ATT&CK under the Execution tactic in the Enterprise matrix, as a sub-technique of T1059 Command and Scripting Interpreter. Threadlinqs maps 10 of 2774 tracked threats (0.4%) to it; by severity that is 8 high, 2 medium.

Threats that use T1059.010 most often also use T1204.002 Malicious File (8 threats), T1082 System Information Discovery (7 threats), T1071.001 Web Protocols (6 threats), T1113 Screen Capture (6 threats), T1140 Deobfuscate/Decode Files or Information (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

4 tracked threat actors appear in the threats that use T1059.010; the most frequent are Handala Hack Team (1), NoName057(16) (1), UNC6692 (1), Water Kurita (1).

Mitigations

MITRE ATT&CK lists 1 mitigation for T1059.010.

• M1038 Execution Prevention

Data sources

Telemetry that can reveal T1059.010, per MITRE ATT&CK.

• Command — Command Execution
• Process — Process Creation

Threat actors using it

• Handala Hack Team 1
• NoName057(16) 1
• UNC6692 1
• Water Kurita 1

Tracked threats

10 tracked threats use T1059.010.

• MALFEX: Malicious npm postinstall supply-chain campaign delivering Overlord RAT and movinlike stealerhigh2026-09-30
• AhnLab ASEC August 2026 APT Attack Trend Report (South Korea): LNK Spear Phishing Delivering XenoRAT and…high2026-09-30
• July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and…high2026-08-28
• Hacktivism as Hybrid Warfare: NoName057(16), Killnet, and Handala Hack Escalate Coordinated Disruption…high2026-08-26
• Microsoft Teams Phishing: Attackers Impersonate IT Helpdesk for Initial Accessmedium2026-08-24
• Fake GoogleTranslate Chrome Extension Enables Remote Browser Control and Credential Theft via Rust Loader…high2026-08-10
• TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Reposhigh2026-08-04
• AutoIT Payload Injector Delivers VIPKeylogger via Phishing/RAR Chain into charmap.exemedium2026-07-28
• Stealer Logs: Infostealer Malware Ecosystem Fuels Credential-Theft Economy (LummaC2, Rhadamanthys, Vidar…high2026-07-25
• UNC6692 Snow Flurries — Microsoft Teams Helpdesk Impersonation Delivers SNOW Malware Suite (SNOWBELT /…high2026-04-23

Detection coverage

Threadlinqs maintains 18 detection rules mapped to T1059.010 (SPL 7, KQL 7, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.

Parent technique

T1059 Command and Scripting Interpreter — 1070 tracked threats at the technique level.