Windows Addinutil.exe Initiates Network Connection
Alerts on network connections initiated by Addinutil.exe, which is uncommon for this utility on Windows.
FreeUnreviewedSigmahighv1
windows-addinutil-exe-initiates-network-connection-5205613d
title: Windows Addinutil.exe Initiates Network Connection
id: 7171883e-5169-4dfd-83f1-3de03e3180ad
status: test
description: This rule flags network connections where the initiating process is Addinutil.exe. Addinutil.exe typically should not start outbound network activity, so unexpected connections may indicate abuse for stealthy command and control. The detection relies on network connection telemetry that includes the process responsible for initiating the connection and its executable path.
references:
- https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/network_connection/net_connection_win_addinutil_initiated.yml
author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri), Huntrule Team
date: 2023-09-18
modified: 2024-07-16
tags:
- attack.stealth
- attack.t1218
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: "true"
Image|endswith: \addinutil.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 5205613d-2a63-4412-a895-3a2458b587b3
type: derived
What it detects
This rule flags network connections where the initiating process is Addinutil.exe. Addinutil.exe typically should not start outbound network activity, so unexpected connections may indicate abuse for stealthy command and control. The detection relies on network connection telemetry that includes the process responsible for initiating the connection and its executable path.
Known false positives
- Unknown
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.