Windows Process Execution: AddInUtil.exe with Uncommon AddInRoot/PipelineRoot Paths

title: "Windows Process Execution: AddInUtil.exe with Uncommon AddInRoot/PipelineRoot Paths"
id: 88914684-e465-4468-b5a1-8c0aaeb0f3ae
status: test
description: "This rule flags execution of AddInUtil.exe when its command line includes -AddInRoot: or -PipelineRoot: values that are not the expected main VSTA installation paths. Attackers may use AddInUtil.exe to blend in while pointing the utility at attacker-controlled Addins.Store content. It relies on Windows process creation telemetry, matching the executable name (ending with \\addinutil.exe / OriginalFileName) and parsing the command line for the relevant parameters and path values."
references:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml
author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri), Huntrule Team
date: 2023-09-18
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \addinutil.exe
    - OriginalFileName: AddInUtil.exe
  selection_cli:
    CommandLine|contains:
      - "-AddInRoot:"
      - "-PipelineRoot:"
  filter_main_addinroot:
    CommandLine|contains:
      - -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -AddInRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -PipelineRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4f2cd9b6-4a17-440f-bb2a-687abb65993a
    type: derived