Windows DLL Side-Loading: SystemResetPlatform.exe Loading RjvPlatform.dll from $SysReset

title: "Windows DLL Side-Loading: SystemResetPlatform.exe Loading RjvPlatform.dll from $SysReset"
id: 6fbbf03c-1ba7-4a87-8a37-688134237e7e
status: test
description: This rule flags when SystemResetPlatform.exe loads RjvPlatform.dll from the C:\$SysReset\Framework\Stack\RjvPlatform.dll path. Attackers may use this pattern to perform DLL side-loading and execute code from an unexpected location. The detection relies on process image-load telemetry indicating the loaded module path for Windows image_load events.
references:
  - https://twitter.com/0gtweet/status/1666716511988330499
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_rjvplatform_default_location.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-09
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image: C:\Windows\System32\SystemResetPlatform\SystemResetPlatform.exe
    ImageLoaded: C:\$SysReset\Framework\Stack\RjvPlatform.dll
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 259dda31-b7a3-444f-b7d8-17f96e8a7d0d
    type: derived