Uncommon AddinUtil.EXE CommandLine Execution

detection:
  filter_main_addinroot:
    CommandLine|contains:
      - '-AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA'
      - '-AddInRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA'
      - '-PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA'
      - '-PipelineRoot:C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA'
  selection_cli:
    CommandLine|contains:
      - '-AddInRoot:'
      - '-PipelineRoot:'
  selection_img:
    - Image|endswith: '\addinutil.exe'
    - OriginalFileName: 'AddInUtil.exe'
  condition: all of selection_* and not 1 of filter_main_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

The commands LOLBAS or GTFOBins documents for addinutil.exe trip it: each is on its program’s page, read by CmdID.