Detection rules › Sigma
Suspicious AddinUtil.EXE CommandLine Execution
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Evasion | T1218 System Binary Proxy Execution |
Event coverage
| Provider | Event ID | Title |
|---|---|---|
| Sysmon | 1 | Process creation |
Stages and Predicates
Stage 1: selection_img
or:
Image|endswith: '\addinutil.exe'
OriginalFileName: AddInUtil.exe
Stage 2: all of selection_susp_1_flags
or:
CommandLine|contains: '-AddInRoot:'
CommandLine|contains: '-PipelineRoot:'
Stage 3: all of selection_susp_1_paths
or:
CommandLine|contains: '\AppData\Local\Temp\'
CommandLine|contains: '\Desktop\'
CommandLine|contains: '\Downloads\'
CommandLine|contains: '\Users\Public\'
CommandLine|contains: '\Windows\Temp\'
Stage 4: selection_susp_2
or:
CommandLine|contains: '-AddInRoot:.'
CommandLine|contains: '-AddInRoot:"."'
CommandLine|contains: '-PipelineRoot:.'
CommandLine|contains: '-PipelineRoot:"."'
or:
CurrentDirectory|contains: '\AppData\Local\Temp\'
CurrentDirectory|contains: '\Desktop\'
CurrentDirectory|contains: '\Downloads\'
CurrentDirectory|contains: '\Users\Public\'
CurrentDirectory|contains: '\Windows\Temp\'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
CurrentDirectory | match |
|
Image | ends_with |
|
OriginalFileName | eq |
|