Query: write Sigma for Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection
Matching passage: Sigma rule: Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection. Logsource: windows / process_creation. Rule: title: Renamed Mavinject.EXE Execution id: e6474a1b-5390-49cd-ab41-8d88655f7394 status: test description: Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md - https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e - https://twitter.com/gN3mes1s/status/941315826107510784 - https://reaqta.com/2017/12/mavinject-microsoft-injector/ - https://twitter.com/Hexacorn/status/776122138063409152 - https://github.com/SigmaHQ/sigma/issues/3742 - https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection author: frack113, Florian Roth date: 2022-12-05 modified: 2023-02-03 tags: - attack.privilege-escalation - attack.stealth - attack.t1055.001 - attack.t1218.013 logsource: category: process_creation product: windows detection: selection: OriginalFileName: - mavinject32.exe - mavinject64.exe filter: Image|endswith: - \mavinject32.exe - \mavinject64.exe condition: selection and not filter falsepositives: - Unlikely level: high
Near-miss passage: Sigma rule: Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may. Logsource: windows / process_creation. Rule: title: Script Interpreter Execution From Suspicious Folder id: 1228c958-e64e-4e71-92ad-7d429f4138ba status: test description: 'Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts. ' references: - https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f - https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military - https://learn.microsoft.com/en-us/windows/win32/shell/csidl author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2022-02-08 modified: 2026-02-17 tags: - attack.execution - attack.t1059 logsource: category: process_creation product: windows detection: selection_proc_image: Image|endswith: - \cscript.exe - \mshta.exe - \wscript.exe selection_proc_flags: CommandLine|contains: - ' -ep bypass ' - ' -ExecutionPolicy bypass ' - ' -w hidden ' - '/e:javascript ' - '/e:Jscript ' - '/e:vbscript ' selection_proc_original: OriginalFileName: - cscript.exe - mshta.exe - wscript.exe selection_folders_1: CommandLine|contains: - :\Perflogs\ - :\Users\Public\ - \%Public% - \AppData\Local\Temp - \AppData\Roaming\Temp - \Temporary Internet - \Windows\Temp - \Start Menu\Programs\Startup\ - '%TEMP%' - '%TMP%' - '%LocalAppData%\Temp' selection_folders_2: - CommandLine|contains|all: - :\Users\ - \Favorites\ - CommandLine|contains|all: - :\Users\ - \Favourites\ - CommandLine|contains|all: - :\Users\ - \Contacts\ - CommandLine|contains|all: - :\Users\ - \Documents\ - CommandLine|contains|all: - :\Users\ - \Music\ - CommandLine|contains|all: - :\Users\ - \Pictures\ - CommandLine|contains|all: - :\Users\ - \Videos\ filter_optional_chocolatey_installer: ParentImage: - C:\Windows\System32\Msiexec.exe - C:\Windows\SysWOW64\Msiexec.exe Image|endswith: \powershell.exe CommandLine|contains|all: - -NoProfile -ExecutionPolicy Bypass -Command - AppData\Local\Temp\ - Install-Chocolatey.ps1 condition: 1 of selection_proc_* and 1 of selection_folders_* and not 1 of filter_optional_* falsepositives: - Various legitimate software have been observed to use similar techniques for installation or update purposes;thus, it is recommended to review and tune filters for your environme