AddInUtil.exe Execution From Uncommon Directory
Detects the execution of AddInUtil.exe, a legitimate Microsoft utility for updating Add-In deployment caches, from a directory that is not a standard Microsoft .NET Framework or WinSxS location. Adversaries may abuse this utility to proxy execution of malicious code, bypass application whitelisting, or evade defenses.
Sigma
