AddinUtil.EXE Execution From Uncommon Directory (6120ac2a-a34b-42c0-a9bd-1fb9f459f348)
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| AddinUtil.EXE Execution From Uncommon Directory (6120ac2a-a34b-42c0-a9bd-1fb9f459f348) | Sigma-Rules | System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4) | Attack Pattern | 1 |