DLL Injection with Mavinject

Hypothesis and description

Injecting a malicious DLL into a process is a common adversary TTP. Although the ways of doing this are numerous, mavinject.exe is a commonly used tool for doing so because it roles up many of the necessary steps into one, and is available within Windows. Attackers may rename the executable, so we also use the common argument "INJECTRUNNING" as a related signature here. Whitelisting certain applications may be necessary to reduce noise for this analytic.

Platforms: Windows
Domain: Host
Subtypes: Process
Submitted: 2020-11-30
Contributors: Olaf Hartong

ATT&CK coverage

Technique	Tactics	Coverage
T1055 Process InjectionT1055.001	Privilege Escalation, Stealth (formerly Defense Evasion)	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1055Process Injection
.001 Dynamic-link Library Injection

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

D3FEND techniques MITRE maps to this analytic

D3-PSA Process Spawn Analysis

Data model references

Fields from the CAR data model (object/action/field) the analytic reads.

Pseudocode and implementations

PseudocodePseudocode - mavinject process and its common argumentData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
mavinject_processes = filter processes where (
  exe = "C:\\Windows\\SysWOW64\\mavinject.exe" OR Image="C:\\Windows\\System32\\mavinject.exe" OR command_line = "*/INJECTRUNNING*"
output mavinject_processes

SplunkSplunk Search - mavinjectData model: Sysmon native

Search for instances of mavinject.exe or mavinject32.exe

(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Windows\\SysWOW64\\mavinject.exe" OR Image="C:\\Windows\\System32\\mavinject.exe" OR CommandLine="*\INJECTRUNNING*")

LogPointLogPoint Search - mavinjectData model: LogPoint native

Search for instances of mavinject.exe or mavinject32.exe

norm_id=WindowsSysmon event_id=1 (image="C:\Windows\SysWOW64\mavinject.exe" OR image="C:\Windows\System32\mavinject.exe" OR command="*\INJECTRUNNING*")

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

12 more in the full list

View CAR-2020-11-003 on car.mitre.org

Hypothesis and description

ATT&CK coverage

Technique	Tactics	Coverage
T1055 Process InjectionT1055.001	Privilege Escalation, Stealth (formerly Defense Evasion)	Low

1 technique, 2 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

T1055Process Injection
.001 Dynamic-link Library Injection

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.

Pseudocode and implementations

PseudocodePseudocode - mavinject process and its common argumentData model: CAR native

This is a pseudocode representation of the below splunk search.

processes = search Process:Create
mavinject_processes = filter processes where (
  exe = "C:\\Windows\\SysWOW64\\mavinject.exe" OR Image="C:\\Windows\\System32\\mavinject.exe" OR command_line = "*/INJECTRUNNING*"
output mavinject_processes

SplunkSplunk Search - mavinjectData model: Sysmon native

Search for instances of mavinject.exe or mavinject32.exe

(index=__your_sysmon_index__ EventCode=1) (Image="C:\\Windows\\SysWOW64\\mavinject.exe" OR Image="C:\\Windows\\System32\\mavinject.exe" OR CommandLine="*\INJECTRUNNING*")

LogPointLogPoint Search - mavinjectData model: LogPoint native

Search for instances of mavinject.exe or mavinject32.exe

norm_id=WindowsSysmon event_id=1 (image="C:\Windows\SysWOW64\mavinject.exe" OR image="C:\Windows\System32\mavinject.exe" OR command="*\INJECTRUNNING*")