Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1218.013_mavinject
Adversaries may abuse mavinject.exe to proxy execution of malicious code.
Passed 20 of 21 test cases with the skill, and 15 of 21 without it.
and 5 more in the full report
6 fixed16 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
A security analyst flagged process execution where mavinject.exe was called with a base address and ordinal number. Which parameter flag enables import descriptor injection via mavinject.exe, and what parameter format does it use?
| Checked | Without skill | With skill |
|---|---|---|
| Specifies the /HMODULE flag for import descriptor injection. | Passed | Passed |
| Formats the parameter syntax using /HMODULE=BASE_ADDRESS followed by DLL path and ordinal number. | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1218
Adversaries may abuse mavinject.exe to proxy execution of malicious code. Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).
Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes (i.e. Dynamic-link Library Injection), allowing for arbitrary code execution (ex. C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL). Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process.
In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its /HMODULE command-line parameter (ex. mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER). This command would inject an import table entry consisting of the specified DLL into the module at the given base address.
Platforms: Windows
Identify Attack Surface: Determine if the target environment is susceptible to Mavinject by examining the target platforms (Windows).
Assess Existing Defenses: Review whether mitigations for T1218.013 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 15 / 21 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.