1<!DOCTYPE html> 2<html lang="en"> 3<head> 4 <meta charset="utf-8"> 5 <title>Addinutil | LOLBAS</title> 6 <link rel="icon" href="/assets/favicon.png"> 7 <link rel="stylesheet" href="/assets/style.css" type="text/css"> 8 <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0, user-scalable=yes"> 9
9<script async defer src="https://buttons.github.io/buttons.js"></script>
9 10
10<script async src="/assets/mitre_attack.js"></script>
10<meta name="title" content="Addinutil on LOLBAS"> 11 <meta name="description" content="AddinUtil.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases."> 12 <meta property="og:title" name="og:title" content="Addinutil on LOLBAS"> 13 <meta property="og:site_name" name="og:site_name" content="LOLBAS"> 14 <meta property="og:type" name="og:type" content="object"> 15 <meta property="og:url" name="og:url" content="https://lolbas-project.github.io/lolbas/Binaries/Addinutil/"> 16 <meta property="og:image" name="og:image" content="https://lolbas-project.github.io/assets/logo.png"> 17 <meta property="og:description" name="og:description" content="AddinUtil.exe is a living-of-the-land file containing unexpected functionality that can be abused by attackers; this page lists all its use cases."> 18</head> 19<body> 20 <a href="https://github.com/LOLBAS-Project/LOLBAS" class="github-corner" aria-label="View source on Github"><svg width="80" height="80" viewBox="0 0 250 250" style="fill:#151513; color:#fff; position: absolute; top: 0; border: 0; right: 0;" aria-hidden="true"><path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path><path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2" fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path><path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z" fill="currentColor" class="octo-body"></path></svg></a><style>.github-corner:hover .octo-arm{animation:octocat-wave 560ms ease-in-out}@keyframes octocat-wave{0%,100%{transform:rotate(0)}20%,60%{transform:rotate(-25deg)}40%,80%{transform:rotate(10deg)}}@media (max-width:500px){.github-corner:hover .octo-arm{animation:none}.github-corner .octo-arm{animation:octocat-wave 560ms ease-in-out}}</style> 21 <h1><a href="/">..</a> /AddinUtil.exe<div class="github-buttons"> 22 <a class="github-button" href="https://github.com/LOLBAS-Project/LOLBAS" data-icon="octicon-star" data-show-count="true" data-size="large" data-color-scheme="no-preference: light; light: light; dark: dark;" aria-label="Star LOLBAS-Project/LOLBAS on GitHub">Star</a> 23 </div> 24</h1> 25 26 <div class="function-list"><div><a href="/lolbas/Binaries/Addinutil/#execute">Execute (.NetObjects)</a></div></div> 27 28 <p>.NET Tool used for updating cache files for Microsoft Office Add-Ins.</p>
vendor: 67 bytes, lines 28-31
28 29 30 31 <script async src="https://www.googletagmanager.com/gtag/js?id=
31UA-133649096-1
vendor: 13 bytes, lines 31-32
31"></script> 32
32<script> 33
vendor: 131 bytes, lines 33-37
33window.dataLayer = window.dataLayer || []; 34 function gtag(){dataLayer.push(arguments);} 35 gtag('js', new Date()); 36 37 gtag('config', '
37UA-133649096-1
vendor: 5 bytes, lines 37-38
37'); 38
38</script>
38 39 40
40<script src="/assets/url_helper.js"></script>
40 41 <section> 42 <h3>Paths:</h3> 43 <ul style="list-style-type:none"> 44 <li data-file-path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe</li> 45 <li data-file-path>C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddinUtil.exe</li> 46 <li data-file-path>C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe</li> 47 <li data-file-path>C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe</li> 48 </ul> 49 </section> 50 <section> 51 <h3>Resources:</h3> 52 <ul> 53 <li><a href="https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html">https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html</a></li> 54 </ul> 55 </section> 56 57 <section> 58 <h3>Acknowledgements:</h3> 59 <ul> 60 <li>Michael McKinley (<a href="https://twitter.com/@MckinleyMike">@MckinleyMike</a>)</li> 61 <li>Tony Latteri (<a href="https://twitter.com/@TheLatteri">@TheLatteri</a>)</li> 62 </ul> 63 </section> 64 65 <section> 66 <h3>Detections:</h3> 67 <ul> 68 <li>Sigma: <a href="https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml" target="_blank" data-shorten="true">https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml</a> 69</li> 70 <li>Sigma: <a href="https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml" target="_blank" data-shorten="true">https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml</a> 71</li> 72 <li>Sigma: <a href="https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml" target="_blank" data-shorten="true">https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml</a> 73</li> 74 <li>Sigma: <a href="https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml" target="_blank" data-shorten="true">https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml</a> 75</li> 76 </ul> 77 </section> 78 79 <section> 80 <h2 id="execute" class="function-name">Execute</h2> 81 <ol> 82 <li> 83 <p>AddinUtil is executed from the directory where the âAddins.Storeâ payload exists, AddinUtil will execute the âAddins.Storeâ payload.</p> 84 85 <pre><code>C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddinUtil.exe -AddinRoot:.</code></pre> 86 <div class="properties"> 87 <dl class="row"><dt class="property">Use case</dt><dd><p>Proxy execution of malicious serialized payload</p> 88</dd></dl> 89 <dl class="row"><dt class="property">Privileges required</dt><dd>User</dd></dl> 90 <dl class="row"><dt class="property">Operating systems</dt><dd>Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11</dd></dl> 91 <dl class="row"><dt class="property">ATT&CK® technique</dt><dd><span data-attack-tid="T1218">T1218</span></dd></dl><dl class="tags row"><dt class="property">Tags</dt><dd><div class="tag tooltip-top tooltip-mobile" data-tooltip="This LOLBAS can execute .NET code via .NET Objects, which can e.g be configured to execute command lines.">Execute: .NetObjects</div></dd></dl> 92 </div> 93 </li> 94 </ol> 95 </section> 96 97
97<script> 98 // add permalink on headings 99 document.querySelectorAll('h2').forEach((heading) => { 100 const link = document.createElement('a'); 101 link.className = 'permalink'; 102 link.href = `#${heading.id}`; 103 heading.appendChild(link); 104 }); 105 </script>
105 106</body> 107</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.