Used by App-v in Windows
Mavinject.exe 4172 /INJECTRUNNING "c:\ads\file.txt:file.dll"
Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172
Inject dll file into running process
C:\Windows\System32\mavinject.exe, C:\Windows\SysWOW64\mavinject.exe
Sigma: https://github.com/SigmaHQ/sigma/blob/6312dd1d44d309608552105c334948f793e89f48/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml, IOC: mavinject.exe should not run unless APP-v is in use on the workstation
Giuseppe N3mes1s (@gN3mes1s), Oddvar Moe (@oddvarmoe)