DLL Injection via MavInject Utility

[rule]
description = "Detects the utilization of the Microsoft MavInject utility to inject an arbitrary library into a remote process."
id = "fccfdee7-b2be-4656-a3ab-9c2808aeff53"
license = "Elastic License v2"
name = "DLL Injection via MavInject Utility"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Mavinject/"]
version = "1.0.5"

query = '''
sequence with maxspan=5s 
 [process where event.action == "start" and
  (process.pe.original_file_name : "mavinject*.exe" or process.name : "mavinject*.exe") and 
   process.args : "/INJECTRUNNING" and not process.parent.executable : "?:\\Windows\\Sys*\\AppVClient.exe"] as event0
 [library where process.pid != 4 and not dll.code_signature.status : "trusted" and 
  stringcontains~(event0.process.command_line, dll.name)]
'''

min_endpoint_version = "8.4.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"

[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.4.0"