Windows Process Injection via Mavinject Using /INJECTRUNNING Flag

Alerts on Windows process creation using Mavinject with /INJECTRUNNING, indicative of DLL injection into a running process.

FreeUnreviewedSigmahighv1

windows-process-injection-via-mavinject-using-injectrunning-flag-4f73421b

title: Windows Process Injection via Mavinject Using /INJECTRUNNING Flag
id: 587e8127-6f7a-4fba-ae90-0a0e94b866c4
related:
  - id: 17eb8e57-9983-420d-ad8a-2c4976c22eb8
    type: obsolete
  - id: 4f73421b-5a0b-4bbf-a892-5a7fb99bea66
    type: derived
status: test
description: This rule flags process injection activity on Windows by detecting the use of the signed Mavinject tool with the /INJECTRUNNING flag. Attackers can use this behavior to load a DLL into an existing process, enabling stealthy execution under the target process context. Telemetry relied on is process creation logging, specifically the created process command line containing the /INJECTRUNNING argument, with an exclusion for an expected AppVClient.exe parent.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md
  - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e
  - https://twitter.com/gN3mes1s/status/941315826107510784
  - https://reaqta.com/2017/12/mavinject-microsoft-injector/
  - https://twitter.com/Hexacorn/status/776122138063409152
  - https://github.com/SigmaHQ/sigma/issues/3742
  - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml
author: frack113, Florian Roth, Huntrule Team
date: 2021-07-12
modified: 2022-12-05
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.001
  - attack.t1218.013
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: " /INJECTRUNNING "
  filter:
    ParentImage: C:\Windows\System32\AppVClient.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags process injection activity on Windows by detecting the use of the signed Mavinject tool with the /INJECTRUNNING flag. Attackers can use this behavior to load a DLL into an existing process, enabling stealthy execution under the target process context. Telemetry relied on is process creation logging, specifically the created process command line containing the /INJECTRUNNING argument, with an exclusion for an expected AppVClient.exe parent.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.