Used by App-v in Windows Located at: C:\Windows\System32\mavinject.exe; C:\Windows\SysWOW64\mavinject.exe.
mavinjectmavinjectSandbox: execFile · Timeout: 30s
security.execution.command system.file.alternate-data-stream Outputs
process.output Command execution output
filesystem_writeprocess_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Inject evil.dll into a process with PID 3110. (Inject dll file into running process)
MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172 (Inject dll file into running process)
Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml |
| ioc | mavinject.exe should not run unless APP-v is in use on the workstation |
mavinject is a Windows LOLBin. Used by App-v in Windows Located at: C:\Windows\System32\mavinject.exe; C:\Windows\SysWOW64\mavinject.exe.