LOL · Binary

Mavinject.exe

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Inject evil.dll into a process with PID 3110.

Use Inject dll file into running process

MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}

Evidence: Upstream reference
Environment: Local host
Context: user
Native: Execute
MITRE: T1218.013
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml
IOC: mavinject.exe should not run unless APP-v is in use on the workstation
Refs: twitter.com/gN3mes1s/status/941315826107510784
twitter.com/Hexcorn/status/776122138063409152
oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
lolbas-project.github.io/lolbas/Binaries/Mavinject/

Defense EvasionFile WriteWindows

Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172

Use Inject dll file into running process

Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll

Evidence: Upstream reference
Environment: Local host
Context: user
Native: ADS
MITRE: T1564.004
Detection: Sigma: github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml
IOC: mavinject.exe should not run unless APP-v is in use on the workstation
Refs: twitter.com/gN3mes1s/status/941315826107510784
twitter.com/Hexcorn/status/776122138063409152
oddvar.moe/2018/01/14/putting-data-in-alternate-data-streams-and-how-to-execute-it/
lolbas-project.github.io/lolbas/Binaries/Mavinject/