.NET Tool used for updating cache files for Microsoft Office Add-Ins.
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.
AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload.
Proxy execution of malicious serliaized payload
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe, C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddinUtil.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml, Sigma: https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml
Michael McKinley (@MckinleyMike), Tony Latteri (@TheLatteri)