Suspicious AddinUtil.EXE CommandLine Execution

Title: Suspicious AddinUtil.EXE CommandLine Execution
Status: test
Description:Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.
References:
  -https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Author: Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\addinutil.exe' OriginalFileName:'AddInUtil.exe'   selection_susp_1_flags:
    CommandLine|contains:
      -'-AddInRoot:'
      -'-PipelineRoot:'

  selection_susp_1_paths:
    CommandLine|contains:
      -'\AppData\Local\Temp\'
      -'\Desktop\'
      -'\Downloads\'
      -'\Users\Public\'
      -'\Windows\Temp\'

  selection_susp_2:
    CommandLine|contains:
      -'-AddInRoot:.'
      -'-AddInRoot:"."'
      -'-PipelineRoot:.'
      -'-PipelineRoot:"."'

    CurrentDirectory|contains:
      -'\AppData\Local\Temp\'
      -'\Desktop\'
      -'\Downloads\'
      -'\Users\Public\'
      -'\Windows\Temp\'

  condition:selection_img and (all of selection_susp_1_* or selection_susp_2)
Falsepositives:
  -Unknown
Level: high