Windows

Mavinject.exeMavinject.exe

Platform
Windows
Abuse functions
2
Mapped techniques
2

Description

Mavinject.exe is a Windows living-off-the-land binary catalogued by the LOLBAS Project. Documented abuse functions: Execute, ADS. Mapped ATT&CK techniques (per LOLBAS / GTFOBins → MITRE crosswalk): T1218, T1564.004. Defenders should monitor execution of Mavinject.exe under non-administrative or sudo contexts and alert when its arguments match the abuse-function signatures.

Abuse functions· 2

ExecuteT1218.013

Inject dll file into running process

Inject dll file into running process

MITRE ATT&CK techniques· 2

T1218.013T1564.004

Uses2

TypeTargetConfidenceTier
SubTechniqueMavinjectt1218.013100%live
SubTechniqueNTFS File Attributest1564.004100%live

Abuses2

TypeTargetConfidenceTier
SubTechniqueNTFS File Attributest1564.00490%live
TechniqueSystem Binary Proxy Executiont121885%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

LOLbin
Ttdinject.exe
Sub-technique
Mavinject
LOLbin
Msiexec.exe
LOLbin
Mpiexec.exe
LOLbin
Devinit.exe
LOLbin
Msdeploy.exe
Sourced from LOLBAS Project. Curated by Adam Lundqvist, SQUR.