attack.t1218.013 | Detection.FYI

Mavinject Inject DLL Into Running Process

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1055.001 attack.t1218.013 ·
Share on:

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Read More
Renamed Mavinject.EXE Execution

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1055.001 attack.t1218.013 ·
Share on:

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Read More