T1218.013sub-technique of T1218 System Binary Proxy Execution
Mavinject
Windowsnothing on this site yetT1218.013 on attack.mitre.org
Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V). Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex.
how MITRE says to see it
Detecting Code Injection via mavinject.exe (App-V Injector)
- Abuse of mavinject.exe to inject DLLs or import descriptors into another running process. Chain: (1) mavinject.exe starts with /INJECTRUNNING or /HMODULE → (2) mavinject obtains high-access handles to a target process (VM_WRITE/CREATE_THREAD) → (3) target process loads attacker DLL (module load) → (4) optional...
what reduces it
- M1038 Execution Prevention. Use application control configured to block execution of mavinject.exe if it is not required for a given system or network to prevent potential misuse by adversaries.
- M1042 Disable or Remove Feature or Program. Consider removing mavinject.exe if Microsoft App-V is not used within a given environment.