Mavinject Inject DLL Into Running Process (4f73421b-5a0b-4bbf-a892-5a7fb99bea66)

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Mavinject Inject DLL Into Running Process (4f73421b-5a0b-4bbf-a892-5a7fb99bea66)	Sigma-Rules	Mavinject - T1218.013 (1bae753e-8e52-4055-a66d-2ead90303ca9)	Attack Pattern	1
Mavinject Inject DLL Into Running Process (4f73421b-5a0b-4bbf-a892-5a7fb99bea66)	Sigma-Rules	Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	1
Mavinject - T1218.013 (1bae753e-8e52-4055-a66d-2ead90303ca9)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	2