AddinUtil.exe

type: OSBinaries

.NET Tool used for updating cache files for Microsoft Office Add-Ins.

Full path

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddinUtil.exe
C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe
C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe

Commands

ExecuteUser T1218
Proxy execution of malicious serialized payload
```
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.
```
AddinUtil is executed from the directory where the ‘Addins.Store’ payload exists, AddinUtil will execute the ‘Addins.Store’ payload.
os: Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute: .NetObjects

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml
Sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml
Sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml
Sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml

Code samples

https://gist.github.com/SILJAEUROPA/a850d476179d73df230a876944e9f3b1#file-addins-store

Resources

https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html

acknowledgement: Michael McKinley @MckinleyMike, Tony Latteri @TheLatteri