{"id":"e6474a1b-5390-49cd-ab41-8d88655f7394","title":"Renamed Mavinject.EXE Execution","description":"Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag","author":"frack113, Florian Roth","status":"test","level":"high","date":"2022-12-05","modified":"2023-02-03","tags":["attack.privilege-escalation","attack.stealth","attack.t1055.001","attack.t1218.013"],"technique_ids":["T1055.001","T1218.013"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unlikely"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md","https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e","https://twitter.com/gN3mes1s/status/941315826107510784","https://reaqta.com/2017/12/mavinject-microsoft-injector/","https://twitter.com/Hexacorn/status/776122138063409152","https://github.com/SigmaHQ/sigma/issues/3742","https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection"],"source_path":"rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml","source_sha256":"dcf1fb7702e0eec3a0c57090cd45c8c0747f5ce17b5c0be313efdc6948b8a332","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Renamed Mavinject.EXE Execution\nid: e6474a1b-5390-49cd-ab41-8d88655f7394\nstatus: test\ndescription: Detects the execution of a renamed version of the \"Mavinject\" process. Which can be abused to perform process injection using the \"/INJECTRUNNING\" flag\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md\n    - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e\n    - https://twitter.com/gN3mes1s/status/941315826107510784\n    - https://reaqta.com/2017/12/mavinject-microsoft-injector/\n    - https://twitter.com/Hexacorn/status/776122138063409152  # Deleted tweet\n    - https://github.com/SigmaHQ/sigma/issues/3742\n    - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection\nauthor: frack113, Florian Roth\ndate: 2022-12-05\nmodified: 2023-02-03\ntags:\n    - attack.privilege-escalation\n    - attack.stealth\n    - attack.t1055.001\n    - attack.t1218.013\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        OriginalFileName:\n            - 'mavinject32.exe'\n            - 'mavinject64.exe'\n    filter:\n        Image|endswith:\n            - '\\mavinject32.exe'\n            - '\\mavinject64.exe'\n    condition: selection and not filter\nfalsepositives:\n    - Unlikely\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1055.001","id":"T1055.001","name":"Dynamic-link Library Injection","page":"techniques/enterprise/T1055.001/"},{"key":"enterprise/T1218.013","id":"T1218.013","name":"Mavinject","page":"techniques/enterprise/T1218.013/"}],"data_path":"data/detection-rules/e6474a1b-5390-49cd-ab41-8d88655f7394.json","kind":"sigma"}