Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into other processes as part of App-V. MITRE ATT&CK tracks its abuse as T1218.013, Mavinject, in the Stealth tactic on Windows.
How attackers use it
MITRE explains that adversaries may use mavinject.exe to inject DLLs into running processes, which is Dynamic-link Library Injection, giving arbitrary code execution. It also supports import descriptor injection through its HMODULE parameter. Since the binary may be signed by Microsoft, the activity runs under a legitimate process and can evade some security products.
How to detect it
The MITRE strategy describes a chain:
- mavinject.exe starts with the INJECTRUNNING or HMODULE parameters.
- It obtains high access handles to a target process, with write and create thread rights.
- The target process loads an attacker DLL.
- Optional child activity or network egress follows from the target process.
Command line logging catches step one. Sysmon event IDs 8 (CreateRemoteThread), 10 (ProcessAccess) and 7 (image load) cover the later steps. If you do not use App-V, any run of mavinject.exe is worth investigating.
How to reduce the risk
- Remove mavinject.exe if Microsoft App-V is not used in your environment.
- Block its execution through application control if it is not required.
Why it matters
Injection hides code inside another process, which makes it harder to trace. Mavinject gives an attacker that ability using a signed Microsoft binary. If you do not use App-V, removing it ends the problem. If you do, restrict who can run it, and watch for the handle access and thread creation that the MITRE chain describes.
Quick check
When is it easy to eliminate this risk entirely?
When you do not use App-V. MITRE suggests removing mavinject.exe in that case.
Sources
- MITRE ATT&CK, T1218.013: https://attack.mitre.org/techniques/T1218/013
