Sigma rule: Mavinject Inject DLL Into Running Process
A detection rule from the SigmaHQ repository, shown as its author published it. Dataset version ref-ddcb6e38df13, updated 2022-12-05T00:00:00.000Z.
Rule
- Title
- Mavinject Inject DLL Into Running Process
- Status
- test
- Level
- high
- Author
- frack113, Florian Roth
- Date
- 2021-07-12
- Modified
- 2022-12-05
- File
- rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml
- Commit
- ccbb0369507f796db0b0ae6854c8a2be471b9d84
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
Log source
- product
- windows
- category
- process_creation
Detection
selection:
CommandLine|contains: ' /INJECTRUNNING '
filter:
ParentImage: 'C:\Windows\System32\AppVClient.exe' # This parent is the expected process to launch "mavinject"
condition: selection and not filterFalse positives (as the rule lists them)
- Unknown
Tags
- attack.privilege-escalation
- attack.stealth
- attack.t1055.001
- attack.t1218.013
MITRE ATT&CK ids this rule names
Related rules
References
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md
- https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
- https://twitter.com/gN3mes1s/status/941315826107510784
- https://reaqta.com/2017/12/mavinject-microsoft-injector/
- https://twitter.com/Hexacorn/status/776122138063409152
- https://github.com/SigmaHQ/sigma/issues/3742
- https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection
Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml
Sources and licences
SigmaHQ
"Mavinject Inject DLL Into Running Process" by frack113, Florian Roth (SigmaHQ). Rule: https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml.
Licensed under the Detection Rule License (DRL) 1.1: https://github.com/SigmaHQ/Detection-Rule-License
Cite this page
Dragons Eye Ransomware Tracker, "Sigma rule: Mavinject Inject DLL Into Running Process",
entity page, dataset version ref-ddcb6e38df13, updated 2022-12-05T00:00:00.000Z,
https://ransomware-tracker.com/detections/sigma/4f73421b-5a0b-4bbf-a892-5a7fb99bea66 (accessed 2026-11-03).
Underlying source: SigmaHQ rule 4f73421b-5a0b-4bbf-a892-5a7fb99bea66, commit ccbb0369507f796db0b0ae6854c8a2be471b9d84.
Pages change. The dataset version identifies the data, but no archive of old versions is kept, so this citation cannot be replayed later.