Detection rules › Sigma

Suspicious AddinUtil.EXE CommandLine Execution

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Source
upstream

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1218 System Binary Proxy Execution

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: selection_img

or:
Image|endswith: '\addinutil.exe'
OriginalFileName: AddInUtil.exe

Stage 2: all of selection_susp_1_flags

or:
CommandLine|contains: '-AddInRoot:'
CommandLine|contains: '-PipelineRoot:'

Stage 3: all of selection_susp_1_paths

or:
CommandLine|contains: '\AppData\Local\Temp\'
CommandLine|contains: '\Desktop\'
CommandLine|contains: '\Downloads\'
CommandLine|contains: '\Users\Public\'
CommandLine|contains: '\Windows\Temp\'

Stage 4: selection_susp_2

or:
CommandLine|contains: '-AddInRoot:.'
CommandLine|contains: '-AddInRoot:"."'
CommandLine|contains: '-PipelineRoot:.'
CommandLine|contains: '-PipelineRoot:"."'
or:
CurrentDirectory|contains: '\AppData\Local\Temp\'
CurrentDirectory|contains: '\Desktop\'
CurrentDirectory|contains: '\Downloads\'
CurrentDirectory|contains: '\Users\Public\'
CurrentDirectory|contains: '\Windows\Temp\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • -AddInRoot: corpus 2 (sigma 2)
  • -AddInRoot:"."
  • -AddInRoot:.
  • -PipelineRoot: corpus 2 (sigma 2)
  • -PipelineRoot:"."
  • -PipelineRoot:.
  • \AppData\Local\Temp\ corpus 16 (sigma 16)
  • \Desktop\ corpus 11 (sigma 11)
  • \Downloads\ corpus 12 (sigma 12)
  • \Users\Public\ corpus 17 (sigma 17)
  • \Windows\Temp\ corpus 10 (sigma 10)
CurrentDirectorymatch
  • \AppData\Local\Temp\
  • \Desktop\
  • \Downloads\
  • \Users\Public\
  • \Windows\Temp\
Imageends_with
  • \addinutil.exe corpus 4 (sigma 4)
OriginalFileNameeq
  • AddInUtil.exe corpus 3 (sigma 3)