Mavinject started with a DLL or import-descriptor injection switch

Siemphony@siemphonymediumT1218.013verified in lab

Matches process creation of the App-V injector carrying `/INJECTRUNNING` or `/HMODULE`, the two switches that make it write a DLL or an import-table entry into a process it did not start — step 1 of MITRE's chain and the only step that is a single event. Both names are matched because an `endswith` on `\mavinject.exe` alone is defeated by the 32-bit `mavinject32.exe` that ships with App-V and with Office Click-to-Run, and `windash` is applied because the argument parser accepts a hyphen wherever the documented form writes a slash. The rule is written in the Sysmon EventID 1 process-creation vocabulary (`Image`, `CommandLine`); the Security EventID 4688 feed the analytic names calls the same path `NewProcessName` and needs a field mapping first, plus *Audit Process Creation* and *Include command line in process creation events*, neither of which is on in a default install. The rest of the chain — the high-access handle, the module load inside the target and any follow-on egress — is a time-windowed correlation Sigma cannot express. Two limitations set the level. On any estate where App-V is published the client injects its subsystem DLLs through this exact command line on ordinary application launches, so the normal case there is a continuous benign match and the rule is only a high-confidence signal once those launches are allowlisted, or on an estate confirmed not to run App-V at all. And the match is on the image name, so copying the Microsoft-signed binary to any other filename defeats both selectors while leaving the technique's value intact — the switches are the rename-resistant half and would need a CommandLine-only companion rule. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0433, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\mavinject.exe" or FolderPath endswith "\\mavinject32.exe") and (ProcessCommandLine contains "-INJECTRUNNING" or ProcessCommandLine contains "/INJECTRUNNING" or ProcessCommandLine contains "–INJECTRUNNING" or ProcessCommandLine contains "—INJECTRUNNING" or ProcessCommandLine contains "―INJECTRUNNING" or ProcessCommandLine contains "-HMODULE" or ProcessCommandLine contains "/HMODULE" or ProcessCommandLine contains "–HMODULE" or ProcessCommandLine contains "—HMODULE" or ProcessCommandLine contains "―HMODULE"))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\mavinject.exe" OR Image="*\\mavinject32.exe") AND (CommandLine="*-INJECTRUNNING*" OR CommandLine="*/INJECTRUNNING*" OR CommandLine="*–INJECTRUNNING*" OR CommandLine="*—INJECTRUNNING*" OR CommandLine="*―INJECTRUNNING*" OR CommandLine="*-HMODULE*" OR CommandLine="*/HMODULE*" OR CommandLine="*–HMODULE*" OR CommandLine="*—HMODULE*" OR CommandLine="*―HMODULE*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\mavinject.exe" OR TO_LOWER(process.executable) LIKE "*\\\\mavinject32.exe") AND (TO_LOWER(process.command_line) LIKE "*-injectrunning*" OR TO_LOWER(process.command_line) LIKE "*/injectrunning*" OR TO_LOWER(process.command_line) LIKE "*–injectrunning*" OR TO_LOWER(process.command_line) LIKE "*—injectrunning*" OR TO_LOWER(process.command_line) LIKE "*―injectrunning*" OR TO_LOWER(process.command_line) LIKE "*-hmodule*" OR TO_LOWER(process.command_line) LIKE "*/hmodule*" OR TO_LOWER(process.command_line) LIKE "*–hmodule*" OR TO_LOWER(process.command_line) LIKE "*—hmodule*" OR TO_LOWER(process.command_line) LIKE "*―hmodule*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\mavinject\.exe$|\\mavinject32\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(-INJECTRUNNING|/INJECTRUNNING|–INJECTRUNNING|—INJECTRUNNING|―INJECTRUNNING|-HMODULE|/HMODULE|–HMODULE|—HMODULE|―HMODULE)</field>    <description>Mavinject started with a DLL or import-descriptor injection switch</description>    <mitre>      <id>T1218.013</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: signed_binary_proxy
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 7a5c27c0-f39a-4d3a-949f-e8aeaa8f18b2

ATT&CKT1218.013

T1218.013Mavinject

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonsigned binary proxy

signed binary proxy

01 · What this rule detects

Attacker code executed through a Microsoft-signed utility so that the execution inherits a trusted signature and a familiar image name — rundll32, regsvr32, mshta, cmstp, msiexec, regasm and their relatives. The binary is legitimate and present on every Windows host; the arguments are what belongs to the attacker. This is worth catching because signature checks, allowlists and any rule that filters on 'signed by Microsoft' will pass it.

02 · Telemetry you need

Process creation with the complete, untruncated command line and the parent — Sysmon EventID 1, or Security 4688 with both Audit Process Creation and the command-line inclusion policy enabled; neither is on by default
Sysmon EventID 7 (ImageLoad) Image and ImageLoaded, to see which module a proxy binary actually loaded
Sysmon EventID 3 (NetworkConnect) tied to the same process id — these binaries fetching remote content is the loudest variant
Sysmon EventID 11 (FileCreate) for the scriptlet, DLL or MSI written just before execution
AppLocker or WDAC audit events (Microsoft-Windows-AppLocker EXE/DLL, MSI and Script logs) — present only where a policy is deployed, even in audit mode

03 · How the logic works

The image name alone is not a detection: rundll32 and msiexec run constantly on a healthy host. Every workable rule in this class is an AND between the image and the shape of its argument. The argument is where the signal lives — a URL or UNC path passed to regsvr32 or msiexec, a scriptlet extension, a protocol handler in an mshta argument, an INF file outside the VPN profile directories for cmstp, a DLL path under a user-writable directory, or rundll32 invoked with no arguments at all. Parentage is the second anchor and often the better one: these binaries launched by an Office application, a browser or a script host mean something quite different from the same binary launched by the installer service. Resist writing one rule per binary with a long keyword list — a rule per binary, anchored on that binary's specific abuse shape, stays readable and tunes independently.

04 · Common false positives

Software distribution running installers — SCCM, Intune and their msiexec invocations, including repair and reinstall
Printer, display and device drivers, which use rundll32 with printui.dll and similar entry points routinely
Control Panel applets and legacy shell handlers invoked through rundll32 by Explorer
Line-of-business applications still shipping HTA front ends, and vendor setup wrappers that call regsvr32 during registration
Genuine VPN client provisioning through cmstp, and .NET installers calling InstallUtil or RegAsm during deployment

05 · Detection maturity

Tier 1 — starting point: Matches known abuse strings in the command line of a handful of these binaries.
Tier 2 — tuned: Pairs each binary with its specific abuse shape and the parent process, excluding software distribution by signed path.
Tier 3 — correlated: Adds the loaded module, the file written immediately before, and whether that module has been seen anywhere else in the fleet.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Baseline the module and entry-point pairs your fleet actually uses for rundll32; the recurring ones are a short list and the outliers are the point of the rule
Alert first on the network-facing arguments — a remote path in the command line is the highest-payoff single condition in this category
Exclude on parent process and account together rather than on the argument, because the argument is the attacker's half
Match the argument case-insensitively and allow for quoting and extra whitespace; these command lines are assembled by hand
Where the telemetry has it, prefer the loaded-module event over the command line for rundll32 — it records what was really loaded rather than what was asked for

Declared by the author

Hosts running Microsoft Application Virtualization, where the App-V client injects its own subsystem DLLs into a virtualized application through exactly this command line. On an estate that has App-V published this fires on ordinary application launches, and MITRE's TargetProcessAllowList knob is where the legitimate injection targets are recorded so the unusual ones stand out.
Application packaging, virtualization-management and software-distribution tooling that drives App-V sequencing or validation during a publish window, invoking the injector under a service account on every package refresh. In a virtualization-heavy estate — App-V sequencing suites, Citrix-style profile and layering agents — this recurs on every publish cycle across many hosts. MITRE names the ParentProcessFilter knob for this; the values are whichever deployment agent your estate runs.
Control-validation runs. The public atomic test for this technique executes the injector with /INJECTRUNNING verbatim, so a scheduled purple-team cycle produces a clean match every time it runs.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification2 runs

Verified in Siemphony lab

Security Datasets — Mavinject DLL injection
passed
Siemphony IR · 3 Sept 2026
3 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1218.013, evaluated against their process_creation events.

Share this rule

/u/siemphony/7a5c27c0-f39a-4d3a-949f-e8aeaa8f18b2

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Mavinject started with a DLL or import-descriptor injection switch

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it