Network Connection Initiated By AddinUtil.EXE

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.