Mavinject.exe

type: OSBinaries

Used by App-v in Windows

Full path

C:\Windows\System32\mavinject.exe
C:\Windows\SysWOW64\mavinject.exe

Commands

ExecuteUser T1218.013
Inject dll file into running process
```
MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}
```
Inject evil.dll into a process with PID 3110.
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute: DLL
ADSUser T1564.004
Inject dll file into running process
```
Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll
```
Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172
os: Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute: DLL

Detection

Sigma https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml
IOCmavinject.exe should not run unless APP-v is in use on the workstation

Resources

acknowledgement: Giuseppe N3mes1s @gN3mes1s, Oddvar Moe @oddvarmoe