Update defense_evasion_masquerading_renamed_autoit.toml

Author: Samirbous

rules/windows/defense_evasion_masquerading_renamed_autoit.toml

@@ -118,7 +118,10 @@ type = "eql"
 
 query = '''
 process where host.os.type == "windows" and event.type == "start" and
-  process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe"
+  (
+   (process.pe.original_file_name : "AutoIt*.exe" and not process.name : "AutoIt*.exe") or
+   (process.pe.original_file_name == "AutoHotkey.exe" and not process.name : ("AutoHotkey*.exe", "InternalAHK.exe"))
+   )
 '''