Uncommon AddinUtil.EXE CommandLine Execution

Title: Uncommon AddinUtil.EXE CommandLine Execution
Status: test
Description:Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.
References:
  -https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
Date: 2023-09-18
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1218'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\addinutil.exe' OriginalFileName:'AddInUtil.exe'   selection_cli:
    CommandLine|contains:
      -'-AddInRoot:'
      -'-PipelineRoot:'

  filter_main_addinroot:
    CommandLine|contains:
      -'-AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA'
      -'-AddInRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA'
      -'-PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA'
      -'-PipelineRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA'

  condition:all of selection_* and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium