Windows: Uncommon Child Processes Spawned by Addinutil.exe

title: "Windows: Uncommon Child Processes Spawned by Addinutil.exe"
id: 515c7b91-323d-427a-b6de-5e5a33d3ab1e
status: test
description: This rule flags process-creation events where Addinutil.exe spawns a child process that is not limited to a small set of expected Windows error/console binaries. Attackers may abuse Addinutil.exe as a proxy to execute additional payloads, making unusual child process ancestry a useful indicator. The detection relies on Windows process creation telemetry, specifically the parent process image ending in addinutil.exe and the child image path endings.
references:
  - https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml
author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri), Huntrule Team
date: 2023-09-18
tags:
  - attack.stealth
  - attack.t1218
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \addinutil.exe
  filter_main_werfault:
    Image|endswith:
      - :\Windows\System32\conhost.exe
      - :\Windows\System32\werfault.exe
      - :\Windows\SysWOW64\werfault.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: b5746143-59d6-4603-8d06-acbd60e166ee
    type: derived