mavinject.exe

mavinject.exe is part of the App-V client. Its supported job is to load a DLL into a target process as part of virtualizing an application. The capability is general, though: given a process ID and a DLL path, it injects that DLL into that process. The genuine binary lives at C:\Windows\System32\mavinject.exe, with a 32-bit copy under SysWOW64.

Legitimately, mavinject is invoked by the App-V infrastructure on systems that run virtualized applications. On a machine without App-V it has essentially no reason to run, so its mere presence in the process tree is worth noting.

mavinject.exe is a signed, off-the-shelf DLL injector (T1218.013, T1055.001). With mavinject <pid> /INJECTRUNNING <dll> an attacker loads their DLL into a chosen process under a trusted Microsoft binary, achieving process injection without writing their own injector and while bypassing application-control rules that allow the tool. Injecting into a legitimate process also lets the code run under that process's identity.

Because mavinject only belongs on App-V systems, it is high-signal almost by default. A mavinject command line that names a target PID and a DLL, especially a DLL in a user-writable directory, is a direct indicator of injection.