AddinUtil.EXE Execution From Uncommon Directory

Title: AddinUtil.EXE Execution From Uncommon Directory
Status: test
Description:Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.
References:
  -https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
modified:2025-02-24
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
Image|endswith:'\addinutil.exe' OriginalFileName:'AddInUtil.exe'   filter_main_legit_location:
    Image|contains:
      -':\Windows\Microsoft.NET\Framework\'
      -':\Windows\Microsoft.NET\Framework64\'
      -':\Windows\Microsoft.NET\FrameworkArm\'
      -':\Windows\Microsoft.NET\FrameworkArm64\'
      -':\Windows\WinSxS\'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium