Mavinject Used for DLL Injection into Process

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to use 'mavinject.exe' for DLL injection into a running process over HTTP. It specifically looks for HTTP requests containing 'mavinject' and '/INJECTRUNNING' in the URI, indicating a potential malicious use of the Mavinject utility for defense evasion.