Network Connection Initiated By AddinUtil.EXE (5205613d-2a63-4412-a895-3a2458b587b3)
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Network Connection Initiated By AddinUtil.EXE (5205613d-2a63-4412-a895-3a2458b587b3) | Sigma-Rules | System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) | Attack Pattern | 1 |