Esc

Mavinject - T1218.013

(ATT&CK® Technique)

Definition

Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1218013["Mavinject"] --> |modifies| ProcessSegment["Process Segment"]; class T1218013 OffensiveTechniqueNode;
        class ProcessSegment ArtifactNode; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment";
        click T1218013 href "/offensive-technique/attack/T1218.013/"; click ProcessSegment href "/dao/artifact/d3f:ProcessSegment"; T1218013["Mavinject"] --> |invokes| CreateThread["Create Thread"]; class T1218013 OffensiveTechniqueNode;
        class CreateThread ArtifactNode; click CreateThread href "/dao/artifact/d3f:CreateThread";
        click T1218013 href "/offensive-technique/attack/T1218.013/"; click CreateThread href "/dao/artifact/d3f:CreateThread";                          SystemCallFiltering["System Call Filtering"] -->
          | filters | CreateThread["Create Thread"];

          SystemCallFiltering["System Call Filtering"] -.->
            | may-isolate | T1218013["Mavinject"] ;
          class SystemCallFiltering DefensiveTechniqueNode;
          class CreateThread ArtifactNode;
          click SystemCallFiltering href "/technique/d3f:SystemCallFiltering";            SystemCallAnalysis["System Call Analysis"] -->
          | analyzes | CreateThread["Create Thread"];

          SystemCallAnalysis["System Call Analysis"] -.->
            | may-detect | T1218013["Mavinject"] ;
          class SystemCallAnalysis DefensiveTechniqueNode;
          class CreateThread ArtifactNode;
          click SystemCallAnalysis href "/technique/d3f:SystemCallAnalysis"; ProcessSegmentExecutionPrevention["Process Segment Execution Prevention"] -->
          | neutralizes | ProcessSegment["Process Segment"];

          ProcessSegmentExecutionPrevention["Process Segment Execution Prevention"] -.->
            | may-harden | T1218013["Mavinject"] ;
          class ProcessSegmentExecutionPrevention DefensiveTechniqueNode;
          class ProcessSegment ArtifactNode;
          click ProcessSegmentExecutionPrevention href "/technique/d3f:ProcessSegmentExecutionPrevention"; SegmentAddressOffsetRandomization["Segment Address Offset Randomization"] -->
          | obfuscates | ProcessSegment["Process Segment"];

          SegmentAddressOffsetRandomization["Segment Address Offset Randomization"] -.->
            | may-harden | T1218013["Mavinject"] ;
          class SegmentAddressOffsetRandomization DefensiveTechniqueNode;
          class ProcessSegment ArtifactNode;
          click SegmentAddressOffsetRandomization href "/technique/d3f:SegmentAddressOffsetRandomization";

json