Renamed Mavinject.EXE Execution (e6474a1b-5390-49cd-ab41-8d88655f7394)

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Renamed Mavinject.EXE Execution (e6474a1b-5390-49cd-ab41-8d88655f7394)	Sigma-Rules	Mavinject - T1218.013 (1bae753e-8e52-4055-a66d-2ead90303ca9)	Attack Pattern	1
Renamed Mavinject.EXE Execution (e6474a1b-5390-49cd-ab41-8d88655f7394)	Sigma-Rules	Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	1
Mavinject - T1218.013 (1bae753e-8e52-4055-a66d-2ead90303ca9)	Attack Pattern	System Binary Proxy Execution - T1218 (457c7820-d331-465a-915e-42f85500ccc4)	Attack Pattern	2
Process Injection - T1055 (43e7dc91-05b2-474c-b9ac-2ed4fe101f4d)	Attack Pattern	Dynamic-link Library Injection - T1055.001 (f4599aa0-4f85-4a32-80ea-fc39dc965945)	Attack Pattern	2