LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Mavinject.exe

View source

Used by App-v in Windows

ExecuteADS
02COMMAND EXAMPLES
02ATT&CK TECHNIQUES
01DETECTION RESOURCES
02CAPABILITIES
01 / TRADECRAFT

Command reference

2 examples

Execute1

EXAMPLE 01T1218.013

Inject evil.dll into a process with PID 3110.

COMMAND
MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}
USE CASE
Inject dll file into running process
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL

ADS1

EXAMPLE 01T1564.004

Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172

COMMAND
Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll
USE CASE
Inject dll file into running process
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Windows\System32\mavinject.exe
C:\Windows\SysWOW64\mavinject.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    mavinject.exe should not run unless APP-v is in use on the workstation

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Giuseppe N3mes1s@gN3mes1s
Oddvar Moe@oddvarmoe