Windows Process Creation: Renamed Mavinject32/64.EXE Execution

title: "Windows Process Creation: Renamed Mavinject32/64.EXE Execution"
id: 2664c824-10e4-4a83-bd53-77cb3dfe9e63
status: test
description: This rule flags process execution where the binary’s OriginalFileName matches mavinject32.exe or mavinject64.exe, excluding cases where the image path ends with the original filename. Attackers can use renamed legitimate utilities to help carry out stealthy process injection workflows, especially when invoking functionality through specific command-line flags. The rule relies on Windows process creation telemetry fields for OriginalFileName and Image path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md
  - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
  - https://twitter.com/gN3mes1s/status/941315826107510784
  - https://reaqta.com/2017/12/mavinject-microsoft-injector/
  - https://twitter.com/Hexacorn/status/776122138063409152
  - https://github.com/SigmaHQ/sigma/issues/3742
  - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml
author: frack113, Florian Roth, Huntrule Team
date: 2022-12-05
modified: 2023-02-03
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.001
  - attack.t1218.013
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName:
      - mavinject32.exe
      - mavinject64.exe
  filter:
    Image|endswith:
      - \mavinject32.exe
      - \mavinject64.exe
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: e6474a1b-5390-49cd-ab41-8d88655f7394
    type: derived