LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

AddinUtil.exe

View source

.NET Tool used for updating cache files for Microsoft Office Add-Ins.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
04DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload.

COMMAND
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.
USE CASE
Proxy execution of malicious serialized payload
PRIVILEGES
User
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · .NetObjects
02 / ON DISK

Known paths

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddinUtil.exe
C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe
C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

4 resources
REFERENCE IMPLEMENTATIONS

Code samples

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Michael McKinley@MckinleyMike
Tony Latteri@TheLatteri