{"id":"4f73421b-5a0b-4bbf-a892-5a7fb99bea66","title":"Mavinject Inject DLL Into Running Process","description":"Detects process injection using the signed Windows tool \"Mavinject\" via the \"INJECTRUNNING\" flag","author":"frack113, Florian Roth","status":"test","level":"high","date":"2021-07-12","modified":"2022-12-05","tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001","attack.t1218.013"],"technique_ids":["T1055.001","T1218.013"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md","https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e","https://twitter.com/gN3mes1s/status/941315826107510784","https://reaqta.com/2017/12/mavinject-microsoft-injector/","https://twitter.com/Hexacorn/status/776122138063409152","https://github.com/SigmaHQ/sigma/issues/3742","https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection"],"source_path":"rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml","source_sha256":"ec000bd3c05ac0073221eea13615cd91986fee12261deb132add7bb18f5e01c8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Mavinject Inject DLL Into Running Process\nid: 4f73421b-5a0b-4bbf-a892-5a7fb99bea66\nrelated:\n    - id: 17eb8e57-9983-420d-ad8a-2c4976c22eb8\n      type: obsolete\nstatus: test\ndescription: Detects process injection using the signed Windows tool \"Mavinject\" via the \"INJECTRUNNING\" flag\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md\n    - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e\n    - https://twitter.com/gN3mes1s/status/941315826107510784\n    - https://reaqta.com/2017/12/mavinject-microsoft-injector/\n    - https://twitter.com/Hexacorn/status/776122138063409152  # Deleted tweet\n    - https://github.com/SigmaHQ/sigma/issues/3742\n    - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection\nauthor: frack113, Florian Roth\ndate: 2021-07-12\nmodified: 2022-12-05\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1055.001\n    - attack.t1218.013\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains: ' /INJECTRUNNING '\n    filter:\n        ParentImage: 'C:\\Windows\\System32\\AppVClient.exe' # This parent is the expected process to launch \"mavinject\"\n    condition: selection and not filter\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055.001","id":"T1055.001","name":"Dynamic-link Library Injection","page":"techniques/enterprise/T1055.001/"},{"key":"enterprise/T1218.013","id":"T1218.013","name":"Mavinject","page":"techniques/enterprise/T1218.013/"}],"data_path":"data/detection-rules/4f73421b-5a0b-4bbf-a892-5a7fb99bea66.json","kind":"sigma"}