Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths

Alerts on AddInUtil.exe runs where AddInRoot/PipelineRoot command-line paths deviate from common VSTA locations.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) (SigmaHQ), DRL 1.1
Published: 2023-09-18
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of AddInUtil.exe when the command line includes -AddInRoot: and/or -PipelineRoot: values that are not limited to the specific main VSTA Common Files paths. Attackers can use AddInUtil.exe with atypical root paths to load or reference adversary-controlled Addins.Store payload locations. The detection relies on Windows process creation telemetry, matching the executable name and the presence and contents of command-line parameters.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious .NET LOLBin Execution via CasPol or RegAsm

Possible DarkGate DLL Sideloading via iTunesHelper Loading CoreFoundation

Suspicious extrac32 CAB Extraction Abuse

Malicious cdb.exe Masquerading as fontdrvhost in ProgramData (via process_creation)

Malicious certutil Decodehex Payload Reconstruction by DarkGate

Malicious MSIX Package Execution via App Installer ms-appinstaller Protocol (via process_creation)

Malicious ViPNet Backdoor Loader via lumpdiag.exe Path Substitution

Suspicious BitLockerToGo Execution from Unusual Parent

Suspicious Proxy Execution via pcalua

Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths

Pivot detection · T1218 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-addinutil-exe-with-uncommon-addinroot-pipelineroot-pat-4f2cd9b6

title: "Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths"
id: 88914684-e465-4468-b5a1-8c0aaeb0f3ae
status: test
description: "This rule identifies execution of AddInUtil.exe when the command line includes -AddInRoot: and/or -PipelineRoot: values that are not limited to the specific main VSTA Common Files paths. Attackers can use AddInUtil.exe with atypical root paths to load or reference adversary-controlled Addins.Store payload locations. The detection relies on Windows process creation telemetry, matching the executable name and the presence and contents of command-line parameters."
references:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml
author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri), Huntrule Team
date: 2023-09-18
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \addinutil.exe
    - OriginalFileName: AddInUtil.exe
  selection_cli:
    CommandLine|contains:
      - "-AddInRoot:"
      - "-PipelineRoot:"
  filter_main_addinroot:
    CommandLine|contains:
      - -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -AddInRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -PipelineRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4f2cd9b6-4a17-440f-bb2a-687abb65993a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL