All Detections

AddinUtil.EXE Execution From Uncommon Directory

avatar
SigmaHQ Detections@sigmaHQ
updated Apr 28, 2026000

Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.

Sigma