Windows: RjvPlatform.dll DLL Sideloading by SystemResetPlatform.exe from Non-Default Path

title: "Windows: RjvPlatform.dll DLL Sideloading by SystemResetPlatform.exe from Non-Default Path"
id: e2e40e3d-3145-4fde-bf99-a50da2b8de53
status: test
description: This rule identifies cases where SystemResetPlatform.exe loads RjvPlatform.dll from a path that does not begin with the expected default directory. DLL sideloading can allow an attacker to execute arbitrary code by forcing a legitimate process to load an attacker-controlled library. It relies on image load telemetry that provides the loaded DLL path and the loading executable path.
references:
  - https://twitter.com/0gtweet/status/1666716511988330499
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_rjvplatform_non_default_location.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-09
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \RjvPlatform.dll
    Image: \SystemResetPlatform.exe
  filter_main_legit_path:
    Image|startswith: C:\Windows\System32\SystemResetPlatform\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 0e0bc253-07ed-43f1-816d-e1b220fe8971
    type: derived