Sigma rule: Renamed Mavinject.EXE Execution

Rule

Title

Renamed Mavinject.EXE Execution

Status

test

Level

high

Author

frack113, Florian Roth

Date

2022-12-05

Modified

2023-02-03

File

rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Log source

product

windows

category

process_creation

Detection

selection:
    OriginalFileName:
        - 'mavinject32.exe'
        - 'mavinject64.exe'
filter:
    Image|endswith:
        - '\mavinject32.exe'
        - '\mavinject64.exe'
condition: selection and not filter

False positives (as the rule lists them)

• Unlikely

Tags

• attack.privilege-escalation
• attack.stealth
• attack.t1055.001
• attack.t1218.013

MITRE ATT&CK ids this rule names

• T1055.001
• T1218.013

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md
• https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
• https://twitter.com/gN3mes1s/status/941315826107510784
• https://reaqta.com/2017/12/mavinject-microsoft-injector/
• https://twitter.com/Hexacorn/status/776122138063409152
• https://github.com/SigmaHQ/sigma/issues/3742
• https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml