Potential RjvPlatform.DLL Sideloading From Non-Default Location
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.
Sigma rule (View on GitHub)
1title: Potential RjvPlatform.DLL Sideloading From Non-Default Location
2id: 0e0bc253-07ed-43f1-816d-e1b220fe8971
3status: test
4description: Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.
5references:
6 - https://twitter.com/0gtweet/status/1666716511988330499
7author: X__Junior (Nextron Systems)
8date: 2023-06-09
9tags:
10 - attack.defense-evasion
11 - attack.privilege-escalation
12 - attack.t1574.001
13logsource:
14 category: image_load
15 product: windows
16detection:
17 selection:
18 ImageLoaded|endswith: '\RjvPlatform.dll'
19 Image: '\SystemResetPlatform.exe'
20 filter_main_legit_path:
21 Image|startswith: 'C:\Windows\System32\SystemResetPlatform\'
22 condition: selection and not 1 of filter_main_*
23falsepositives:
24 - Unlikely
25level: high
References
Related rules
- Creation Of Non-Existent System DLL
- DLL Search Order Hijackig Via Additional Space in Path
- DLL Sideloading Of ShellChromeAPI.DLL
- Lazarus APT DLL Sideloading Activity
- Malicious DLL File Dropped in the Teams or OneDrive Folder