Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths

Alerts on AddInUtil.exe runs where AddInRoot/PipelineRoot command-line paths deviate from common VSTA locations.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri) (SigmaHQ), DRL 1.1
Published: 2023-09-18
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of AddInUtil.exe when the command line includes -AddInRoot: and/or -PipelineRoot: values that are not limited to the specific main VSTA Common Files paths. Attackers can use AddInUtil.exe with atypical root paths to load or reference adversary-controlled Addins.Store payload locations. The detection relies on Windows process creation telemetry, matching the executable name and the presence and contents of command-line parameters.

Reporting behind it

Related detections9 linkedT1218 — drag to rearrange

Suspicious Cabinet Extraction of Masqueraded vstm Archive via extrac32

Malicious DLL Execution via Wuauclt Update Handler (via process_creation)

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious RegAsm or RegSvcs Spawned by Script Host (via process_creation)

Suspicious Extexport DLL Side-Loading Execution

Malicious ClickFix Execution Chain Spawning MSHTA via Pcalua on EtherRAT Infection

Suspicious TALONITE Certutil LOLBIN Decode and Download Abuse (via process_creation)

Suspicious Renamed git Binary gcmd.exe Execution (via process_creation)

Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths

Pivot detection · T1218 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-execution-addinutil-exe-with-uncommon-addinroot-pipelineroot-pat-4f2cd9b6

title: "Windows Process Creation: Uncommon AddInUtil.exe Use of AddInRoot/PipelineRoot Paths"
id: 88914684-e465-4468-b5a1-8c0aaeb0f3ae
status: test
description: "This rule identifies execution of AddInUtil.exe when the command line includes -AddInRoot: and/or -PipelineRoot: values that are not limited to the specific main VSTA Common Files paths. Attackers can use AddInUtil.exe with atypical root paths to load or reference adversary-controlled Addins.Store payload locations. The detection relies on Windows process creation telemetry, matching the executable name and the presence and contents of command-line parameters."
references:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml
author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri), Huntrule Team
date: 2023-09-18
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \addinutil.exe
    - OriginalFileName: AddInUtil.exe
  selection_cli:
    CommandLine|contains:
      - "-AddInRoot:"
      - "-PipelineRoot:"
  filter_main_addinroot:
    CommandLine|contains:
      - -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -AddInRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
      - -PipelineRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA
  condition: all of selection_* and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 4f2cd9b6-4a17-440f-bb2a-687abb65993a
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL