Suspicious AddinUtil.EXE CommandLine Execution

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.