Windows: Detect AddInUtil.exe Execution from Non-Standard Directory

title: "Windows: Detect AddInUtil.exe Execution from Non-Standard Directory"
id: 1499a718-f07b-4fbf-80ba-8a31aeba8b3e
status: test
description: This rule flags process creation where AddInUtil.exe is executed from a directory that does not match common Windows .NET and WinSxS locations. Attackers may use this signed utility to blend in while executing from unusual paths to evade basic allowlists. Detection relies on Windows process creation telemetry, matching the executable name and filtering out known legitimate install/cache directories by path content.
references:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml
author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri), Huntrule Team
date: 2023-09-18
modified: 2025-02-24
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \addinutil.exe
    - OriginalFileName: AddInUtil.exe
  filter_main_legit_location:
    Image|contains:
      - :\Windows\Microsoft.NET\Framework\
      - :\Windows\Microsoft.NET\Framework64\
      - :\Windows\Microsoft.NET\FrameworkArm\
      - :\Windows\Microsoft.NET\FrameworkArm64\
      - :\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6120ac2a-a34b-42c0-a9bd-1fb9f459f348
    type: derived