# T1059.010 AutoHotKey & AutoIT > As of 2026-10-12, T1059.010 (AutoHotKey & AutoIT) appears in 10 tracked threats, first reported 2026-04-23 and most recently 2026-09-30, with linked actors including Handala Hack Team, NoName057(16), UNC6692; it most often appears alongside T1204.002 (Malicious File). - **Tracked threats:** 10 (8 high, 2 medium) - **First seen:** 2026-04-23 - **Last seen:** 2026-09-30 - **Threat actors:** 4 - **Detection rules:** 18 (counts only; Blue tier and above) ## Key facts - **ID:** T1059.010 - **Framework:** MITRE ATT&CK - **Tactics:** Execution - **Matrix:** Enterprise - **Parent:** T1059 - **Data as of:** 2026-10-12 - **MITRE:** https://attack.mitre.org/techniques/T1059/010/ ## Activity timeline T1059.010 first appeared in tracked threats on 2026-04-23 and was most recently reported on 2026-09-30. The busiest month was 2026-08 with 5 reports, and 10 of the 10 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1059.010 AutoHotKey & AutoIT is catalogued by MITRE ATT&CK under the Execution tactic in the Enterprise matrix, as a sub-technique of [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059). Threadlinqs maps 10 of 2774 tracked threats (0.4%) to it; by severity that is 8 high, 2 medium. Threats that use T1059.010 most often also use [T1204.002 Malicious File](https://intel.threadlinqs.com/technique/T1204.002) (8 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (7 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (6 threats), [T1113 Screen Capture](https://intel.threadlinqs.com/technique/T1113) (6 threats), [T1140 Deobfuscate/Decode Files or Information](https://intel.threadlinqs.com/technique/T1140) (6 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 4 tracked threat actors appear in the threats that use T1059.010; the most frequent are [Handala Hack Team](https://intel.threadlinqs.com/actor/Handala%20Hack%20Team) (1), [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)) (1), [UNC6692](https://intel.threadlinqs.com/actor/UNC6692) (1), [Water Kurita](https://intel.threadlinqs.com/actor/Water%20Kurita) (1). ## Mitigations MITRE ATT&CK lists 1 mitigation for T1059.010. - [M1038 Execution Prevention](https://attack.mitre.org/mitigations/M1038/) ## Data sources Telemetry that can reveal T1059.010, per MITRE ATT&CK. - Command — Command Execution - Process — Process Creation ## Threat actors using it - [Handala Hack Team](https://intel.threadlinqs.com/actor/Handala%20Hack%20Team) — 1 - [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)) — 1 - [UNC6692](https://intel.threadlinqs.com/actor/UNC6692) — 1 - [Water Kurita](https://intel.threadlinqs.com/actor/Water%20Kurita) — 1 ## Tracked threats 10 tracked threats use T1059.010. - [MALFEX: Malicious npm postinstall supply-chain campaign delivering Overlord RAT and movinlike stealer](https://intel.threadlinqs.com/threat/TL-2026-2801) — high — 2026-09-30 - [AhnLab ASEC August 2026 APT Attack Trend Report (South Korea): LNK Spear Phishing Delivering XenoRAT and…](https://intel.threadlinqs.com/threat/TL-2026-2800) — high — 2026-09-30 - [July 2026 Domestic APT Attack Trends (South Korea): LNK-Based Spear Phishing Delivering XenoRAT and…](https://intel.threadlinqs.com/threat/TL-2026-2180) — high — 2026-08-28 - [Hacktivism as Hybrid Warfare: NoName057(16), Killnet, and Handala Hack Escalate Coordinated Disruption…](https://intel.threadlinqs.com/threat/TL-2026-2154) — high — 2026-08-26 - [Microsoft Teams Phishing: Attackers Impersonate IT Helpdesk for Initial Access](https://intel.threadlinqs.com/threat/TL-2026-2129) — medium — 2026-08-24 - [Fake GoogleTranslate Chrome Extension Enables Remote Browser Control and Credential Theft via Rust Loader…](https://intel.threadlinqs.com/threat/TL-2026-1976) — high — 2026-08-10 - [TroyDens — Fake AI Tool Campaign Delivers SmartLoader Info-Stealer via Trojanized GitHub Repos](https://intel.threadlinqs.com/threat/TL-2026-1859) — high — 2026-08-04 - [AutoIT Payload Injector Delivers VIPKeylogger via Phishing/RAR Chain into charmap.exe](https://intel.threadlinqs.com/threat/TL-2026-1740) — medium — 2026-07-28 - [Stealer Logs: Infostealer Malware Ecosystem Fuels Credential-Theft Economy (LummaC2, Rhadamanthys, Vidar…](https://intel.threadlinqs.com/threat/TL-2026-1693) — high — 2026-07-25 - [UNC6692 Snow Flurries — Microsoft Teams Helpdesk Impersonation Delivers SNOW Malware Suite (SNOWBELT /…](https://intel.threadlinqs.com/threat/TL-2026-0415) — high — 2026-04-23 ## Detection coverage Threadlinqs maintains 18 detection rules mapped to T1059.010 (SPL 7, KQL 7, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only. 18 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Parent technique [T1059 Command and Scripting Interpreter](https://intel.threadlinqs.com/technique/T1059) — 1070 tracked threats at the technique level. ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1059.010 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)