Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

Network Connection Initiated By AddinUtil.EXE

Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Michael McKinley, Tony LatteriCreated Mon Sep 18Updated Tue Jul 165205613d-2a63-4412-a895-3a2458b587b3windows
Log Source
WindowsNetwork Connection
ProductWindows← raw: windows
CategoryNetwork Connection← raw: network_connection

Events for outbound and inbound network connections including DNS resolution.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        Initiated: 'true'
        Image|endswith: '\addinutil.exe'
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References
1
Resolving title…
blue-prints.blog
MITRE ATT&CK
Rule Metadata
Rule ID
5205613d-2a63-4412-a895-3a2458b587b3
Status
test
Level
high
Type
Detection
Created
Mon Sep 18
Modified
Tue Jul 16
Author
Michael McKinley, Tony Latteri
Path
rules/windows/network_connection/net_connection_win_addinutil_initiated.yml
Raw Tags
attack.defense-evasionattack.t1218
View on GitHub