T1218.013 — Mavinject

Tactic: Stealth · Platforms: Windows

Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V). Adversaries may abuse mavinject.exe…

Sub-technique of System Binary Proxy Execution (T1218).

Sigma detection rules (1)

T1218.013 System Binary Proxy Execution: Mavinject

title: "T1218.013 System Binary Proxy Execution: Mavinject"
id: c48d4073-1715-41cc-a218-faa569cf1596
description: 'Detecting Code Injection via mavinject.exe (App-V Injector). (Data Component: Process Access; baseline tier: windows-eventid.) Tune using: TimeWindow, DLLPathRegex, TargetProcessAllowList, MinGrantedAccessSet, ParentProcessFilter, ExternalIPAllowlist.'
references:
  - https://attack.mitre.org/techniques/T1218/013
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.stealth
  - attack.t1218.013

logsource:
  category: process_access
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '10'
    SourceImage|endswith: '\mavinject.exe'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate App-V sequencing or virtualization operations invoking mavinject.exe against a target process.

level: medium

Related sub-techniques

Explore