Title:Potential RjvPlatform.DLL Sideloading From Non-Default Location Status:test Description:Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location. References: -https://twitter.com/0gtweet/status/1666716511988330499 Author: X__Junior (Nextron Systems) Date: 2023-06-09 modified:None Tags:
-'attack.persistence'
-'attack.privilege-escalation'
-'attack.execution'
-'attack.stealth'
-'attack.t1574.001'
Logsource:
category: image_load
product: windows
Detection: selection: ImageLoaded|endswith:
'\RjvPlatform.dll' Image:
'\SystemResetPlatform.exe' filter_main_legit_path: Image|startswith:
'C:\Windows\System32\SystemResetPlatform\' condition:selection and not 1 of filter_main_* Falsepositives:
-Unlikely Level:high
