{"id":"T1218.013","name":"Mavinject","url":"https://attack.mitre.org/techniques/T1218/013","tactics":["stealth"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0433","stix_id":"x-mitre-detection-strategy--621ecbd0-a183-4dbd-913c-656436e62c1d","name":"Detecting Code Injection via mavinject.exe (App-V Injector)","url":"https://attack.mitre.org/detectionstrategies/DET0433","analytics":[{"id":"AN1207","stix_id":"x-mitre-analytic--0fff438f-1aa9-4424-be94-a08b400adcb0","name":"Analytic 1207","description":"Abuse of mavinject.exe to inject DLLs or import descriptors into another running process. Chain: (1) mavinject.exe starts with /INJECTRUNNING or /HMODULE → (2) mavinject obtains high-access handles to a target process (VM_WRITE/CREATE_THREAD) → (3) target process loads attacker DLL (module load) → (4) optional follow-on child activity or network egress from the target process.","url":"https://attack.mitre.org/detectionstrategies/DET0433#AN1207","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4688","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=10","data_component":"DC0035","data_component_name":"Process Access","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"TimeWindow","description":"Correlation interval (e.g., 5–10 minutes) linking mavinject start → ProcessAccess → module load/network from the target process."},{"field":"DLLPathRegex","description":"Patterns for suspicious DLL locations (e.g., %TEMP%, Downloads, UNC shares) to reduce noise from legitimate injections."},{"field":"TargetProcessAllowList","description":"Common legitimate targets for App-V (if used) to suppress; flag unusual targets like browsers, LSASS, Winlogon, EDR processes."},{"field":"MinGrantedAccessSet","description":"Set of access rights that imply injection (VM_WRITE, VM_OPERATION, CREATE_THREAD). Tune for your EDR/sysmon formatting."},{"field":"ParentProcessFilter","description":"Legitimate parents starting mavinject (e.g., App-V services) vs. suspicious parents (Office, script hosts, browsers)."},{"field":"ExternalIPAllowlist","description":"Known enterprise update/CDN ranges to exclude when correlating post-injection network activity."},{"field":"SignedToUnsignedTransition","description":"Alerting when Microsoft-signed mavinject leads to loading unsigned DLLs in a target process."}],"live":true,"detection_strategies":["DET0433"],"techniques":["T1218.013"]}],"live":true,"version":"1.0","techniques":["T1218.013"]}],"sigma_rules":[{"id":"4f73421b-5a0b-4bbf-a892-5a7fb99bea66","title":"Mavinject Inject DLL Into Running Process","author":"frack113, Florian Roth","status":"test","level":"high","date":"2021-07-12","modified":"2022-12-05","description":"Detects process injection using the signed Windows tool \"Mavinject\" via the \"INJECTRUNNING\" flag","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md","https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e","https://twitter.com/gN3mes1s/status/941315826107510784","https://reaqta.com/2017/12/mavinject-microsoft-injector/","https://twitter.com/Hexacorn/status/776122138063409152","https://github.com/SigmaHQ/sigma/issues/3742","https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001","attack.t1218.013"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml","techniques":["T1055.001","T1218.013"],"cves":[]},{"id":"e6474a1b-5390-49cd-ab41-8d88655f7394","title":"Renamed Mavinject.EXE Execution","author":"frack113, Florian Roth","status":"test","level":"high","date":"2022-12-05","modified":"2023-02-03","description":"Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md","https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e","https://twitter.com/gN3mes1s/status/941315826107510784","https://reaqta.com/2017/12/mavinject-microsoft-injector/","https://twitter.com/Hexacorn/status/776122138063409152","https://github.com/SigmaHQ/sigma/issues/3742","https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001","attack.t1218.013"],"path":"rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml","techniques":["T1055.001","T1218.013"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}