Renamed Mavinject.EXE Execution

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2023•0•0•0

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag