addinutil.exe

AddInUtil.exe file version info (xCyclopedia)

LOLBAS Execute 3 Sigma rules name it 1 ATT&CK technique 1 documented command 2 known copies with hashes

How addinutil.exe is abused

documented by LOLBAS

Execute T1218 System Binary Proxy Execution

-addinroot

Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for addinutil.exe.

1 documented command

from LOLBAS, each read by the identifier

Execute T1218 System Binary Proxy Execution User privileges

AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload.

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.

Identify

Trips 1 Sigma rule: mediumUncommon AddinUtil.EXE CommandLine Execution by Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)

The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for addinutil.exe, by Michael McKinley @MckinleyMike, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for addinutil.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.

What detects it

Sigma process creation rules

highSuspicious AddinUtil.EXE CommandLine ExecutionNasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)

mediumUncommon AddinUtil.EXE CommandLine ExecutionMichael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)

mediumAddinUtil.EXE Execution From Uncommon DirectoryMichael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)

T1218System Binary Proxy Execution

Is it the real addinutil.exe?

file version info and known copies

Installed inC:\Windows\Microsoft.NET\Framework\v4.0.30319\

Signed byMicrosoft Windows

ProductMicrosoft .NET Framework, Microsoft Corporation

DescriptionAddInUtil.exe

2 known copies

4.8.4161.0 built by: NET48REL1 · C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe · signed by Microsoft Windows

93091f1a0c8605f400a259bb49bd13ef4c195a1e9183989fa4ebe44f8cd22f1b

4.8.4084.0 built by: NET48REL1 · C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe · signed by Microsoft Windows

eba869ef2a566f1aa776344717e894a863b5bbca79807e410c651d54d7c4d96d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.