Suspicious AddinUtil.EXE CommandLine Execution
Detects the execution of the Add-In deployment cache updating utility (AddInUtil.exe) when it is used with suspicious AddInRoot or PipelineRoot paths. Adversaries may leverage this legitimate utility to load their malicious add-ins by pointing to uncommon or user-controlled directories like temporary folders, desktop, downloads, or public user directories. This technique can be used for defense evasion by proxying execution through a trusted binary.
Sigma
