Techniques › T1218.013 › AN1207
AN1207 Analytic 1207
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Abuse of mavinject.exe to inject DLLs or import descriptors into another running process. Chain: (1) mavinject.exe starts with /INJECTRUNNING or /HMODULE → (2) mavinject obtains high-access handles to a target process (VM_WRITE/CREATE_THREAD) → (3) target process loads attacker DLL (module load) → (4) optional follow-on child activity or network egress from the target process.</p>
- Detects
- T1218.013 Mavinject
- Part of
- DET0433 Detecting Code Injection via mavinject.exe (App-V Injector)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Security | EventCode=4688 | DC0032 Process Creation |
| WinEventLog:Sysmon | EventCode=10 | DC0035 Process Access |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
| WinEventLog:Sysmon | EventCode=11 | DC0039 File Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:Sysmon | EventCode=3, 22 | DC0082 Network Connection Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Correlation interval (e.g., 5–10 minutes) linking mavinject start → ProcessAccess → module load/network from the target process. |
DLLPathRegex | Patterns for suspicious DLL locations (e.g., %TEMP%, Downloads, UNC shares) to reduce noise from legitimate injections. |
TargetProcessAllowList | Common legitimate targets for App-V (if used) to suppress; flag unusual targets like browsers, LSASS, Winlogon, EDR processes. |
MinGrantedAccessSet | Set of access rights that imply injection (VM_WRITE, VM_OPERATION, CREATE_THREAD). Tune for your EDR/sysmon formatting. |
ParentProcessFilter | Legitimate parents starting mavinject (e.g., App-V services) vs. suspicious parents (Office, script hosts, browsers). |
ExternalIPAllowlist | Known enterprise update/CDN ranges to exclude when correlating post-injection network activity. |
SignedToUnsignedTransition | Alerting when Microsoft-signed mavinject leads to loading unsigned DLLs in a target process. |