Network Connection Initiated By AddinUtil.EXE

Title: Network Connection Initiated By AddinUtil.EXE
Status: test
Description:Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
References:
  -https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
modified:2024-07-16
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: network_connection
• product: windows

Detection:
  selection:
    Initiated: 'true'
    Image|endswith: '\addinutil.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high