Windows Process Creation: AddInUtil.exe with Suspicious AddInRoot/PipelineRoot Paths

Alerts on AddInUtil.exe runs using uncommon AddInRoot/PipelineRoot values targeting Temp, Desktop, Downloads, or public user paths.

FreeUnreviewedSigmahighv1

windows-process-creation-addinutil-exe-with-suspicious-addinroot-pipelineroot-pa-631b22a4

title: "Windows Process Creation: AddInUtil.exe with Suspicious AddInRoot/PipelineRoot Paths"
id: ceadd7ce-3963-4f89-af48-73e405856ef7
status: test
description: This rule flags execution of AddInUtil.exe when the command line includes AddInRoot and/or PipelineRoot arguments pointing to unusual locations such as Temp, Desktop, Downloads, Users\Public, or Windows\Temp. It matters because attackers can abuse AddInUtil.exe to stage or load add-in content from attacker-controlled paths. Detection relies on Windows process creation telemetry capturing the executable name and the full command line, and in one case the current working directory.
references:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml
author: Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri), Huntrule Team
date: 2023-09-18
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \addinutil.exe
    - OriginalFileName: AddInUtil.exe
  selection_susp_1_flags:
    CommandLine|contains:
      - "-AddInRoot:"
      - "-PipelineRoot:"
  selection_susp_1_paths:
    CommandLine|contains:
      - \AppData\Local\Temp\
      - \Desktop\
      - \Downloads\
      - \Users\Public\
      - \Windows\Temp\
  selection_susp_2:
    CommandLine|contains:
      - -AddInRoot:.
      - -AddInRoot:"."
      - -PipelineRoot:.
      - -PipelineRoot:"."
    CurrentDirectory|contains:
      - \AppData\Local\Temp\
      - \Desktop\
      - \Downloads\
      - \Users\Public\
      - \Windows\Temp\
  condition: selection_img and (all of selection_susp_1_* or selection_susp_2)
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 631b22a4-70f4-4e2f-9ea8-42f84d9df6d8
    type: derived

What it detects

This rule flags execution of AddInUtil.exe when the command line includes AddInRoot and/or PipelineRoot arguments pointing to unusual locations such as Temp, Desktop, Downloads, Users\Public, or Windows\Temp. It matters because attackers can abuse AddInUtil.exe to stage or load add-in content from attacker-controlled paths. Detection relies on Windows process creation telemetry capturing the executable name and the full command line, and in one case the current working directory.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.