Renamed Mavinject.EXE Execution
Detects the execution of a renamed version of the "Mavinject" process. Mavinject.exe is a legitimate Microsoft utility that can be abused to perform process injection, often using the "/INJECTRUNNING" flag. This rule specifically looks for instances where the original file name (mavinject32.exe or mavinject64.exe) does not match the executed image name, indicating a potential rename for defense evasion.
Sigma
