Mavinject DLL Injection into Running Process

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•37

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag. This activity is suspicious when not initiated by the expected parent process, 'AppVClient.exe'.