Description
AutoKMS refers to tools that bypass Microsoft Office and Windows license activation by impersonating the volume licensing service. These tools run with elevated privileges and connect to untrusted services, and cyberattackers have trojanized popular copies to deliver miners and stealers, which makes their presence on managed systems a policy and security concern.
Stats
- First seen
- July 2023
- Last seen
- October 2026
Alert name variants
| Alert Name |
|---|
| Application.AutoKMS.1 |
| Application.AutoKMS.12 |
| Application.AutoKMS.13 |
| Application.HackTool.AutoKMS.19 |
| Gen:Variant.Application.AutoKMS.16 |
| Gen:Variant.Application.AutoKMS.21 |
| Gen:Variant.Application.AutoKMS.3 |
| Gen:Variant.Application.AutoKMS.30 |
| Gen:Variant.Application.HackTool.AutoKMS.21 |
| Gen:Variant.Application.HackTool.AutoKMS.4 |