Mavinject started with a DLL or import-descriptor injection switch

1title: Mavinject started with a DLL or import-descriptor injection switch2id: 7a5c27c0-f39a-4d3a-949f-e8aeaa8f18b23status: experimental4description: |5  Matches process creation of the App-V injector carrying `/INJECTRUNNING` or6  `/HMODULE`, the two switches that make it write a DLL or an import-table entry7  into a process it did not start — step 1 of MITRE's chain and the only step8  that is a single event. Both names are matched because an `endswith` on9  `\mavinject.exe` alone is defeated by the 32-bit `mavinject32.exe` that ships10  with App-V and with Office Click-to-Run, and `windash` is applied because the11  argument parser accepts a hyphen wherever the documented form writes a slash.12  The rule is written in the Sysmon EventID 1 process-creation vocabulary13  (`Image`, `CommandLine`); the Security EventID 4688 feed the analytic names14  calls the same path `NewProcessName` and needs a field mapping first, plus15  *Audit Process Creation* and *Include command line in process creation events*,16  neither of which is on in a default install. The rest of the chain — the17  high-access handle, the module load inside the target and any follow-on egress18  — is a time-windowed correlation Sigma cannot express. Two limitations set the19  level. On any estate where App-V is published the client injects its subsystem20  DLLs through this exact command line on ordinary application launches, so the21  normal case there is a continuous benign match and the rule is only a22  high-confidence signal once those launches are allowlisted, or on an estate23  confirmed not to run App-V at all. And the match is on the image name, so24  copying the Microsoft-signed binary to any other filename defeats both25  selectors while leaving the technique's value intact — the switches are the26  rename-resistant half and would need a CommandLine-only companion rule.27  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0433, not hand-written and not tested by its author. Any lab result is on this rule's own page.28references:29  - https://attack.mitre.org/techniques/T1218/01330  - https://attack.mitre.org/detectionstrategies/DET043331author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)32date: 2026-08-1633tags:34  - attack.defense-evasion35  - attack.t1218.01336logsource:37  category: process_creation38  product: windows39detection:40  selection_image:41    Image|endswith:42      - '\mavinject.exe'43      - '\mavinject32.exe'44  selection_switch:45    CommandLine|contains|windash:46      - '/INJECTRUNNING'47      - '/HMODULE'48  condition: selection_image and selection_switch49falsepositives:50  - "Hosts running Microsoft Application Virtualization, where the App-V client injects its own subsystem DLLs into a virtualized application through exactly this command line. On an estate that has App-V published this fires on ordinary application launches, and MITRE's TargetProcessAllowList knob is where the legitimate injection targets are recorded so the unusual ones stand out."51  - "Application packaging, virtualization-management and software-distribution tooling that drives App-V sequencing or validation during a publish window, invoking the injector under a service account on every package refresh. In a virtualization-heavy estate — App-V sequencing suites, Citrix-style profile and layering agents — this recurs on every publish cycle across many hosts. MITRE names the ParentProcessFilter knob for this; the values are whichever deployment agent your estate runs."52  - "Control-validation runs. The public atomic test for this technique executes the injector with /INJECTRUNNING verbatim, so a scheduled purple-team cycle produces a clean match every time it runs."53level: medium