windows enabled community high v1.0.0

addinutil

.NET Tool used for updating cache files for Microsoft Office Add-Ins. Located at: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddinUtil.exe; C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe.

📋 Live Preview 
addinutil
addinutil

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload. (Proxy execution of malicious serialized payload)

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml
sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml
sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml
sigma https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml

Documentation

addinutil

addinutil is a Windows LOLBin. .NET Tool used for updating cache files for Microsoft Office Add-Ins. Located at: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddinUtil.exe; C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe.

References