AddinUtil.EXE Execution From Unusual Directory (via process_creation)

title: AddinUtil.EXE Execution From Unusual Directory (via process_creation)
id: d2f68cf3-fccd-5999-a87e-5a25bd08b56d
status: stable
description: This rule detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.
references:
    - https://attack.mitre.org/techniques/T1218/
    - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
author: Huntrule Team
date: 2026-04-29
tags:
    - attack.stealth
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image|endswith: '\addinutil.exe'
        - OriginalFileName: 'AddInUtil.exe'
    filter_main_legit_location:
        Image|contains:
            - ':\Windows\Microsoft.NET\Framework\'
            - ':\Windows\Microsoft.NET\Framework64\'
            - ':\Windows\Microsoft.NET\FrameworkArm\'
            - ':\Windows\Microsoft.NET\FrameworkArm64\'
            - ':\Windows\WinSxS\'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium