Renamed Mavinject.EXE Execution — Detection Rule

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

Read the full analysis on IntelFusions