Detectionhightest
Potential RjvPlatform.DLL Sideloading From Non-Default Location
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsImage Load (DLL)
ProductWindows← raw: windows
CategoryImage Load (DLL)← raw: image_load
Detection Logic
Detection Logic2 selectors
detection:
selection:
ImageLoaded|endswith: '\RjvPlatform.dll'
Image: '\SystemResetPlatform.exe'
filter_main_legit_path:
Image|startswith: 'C:\Windows\System32\SystemResetPlatform\'
condition: selection and not 1 of filter_main_*False Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
References
MITRE ATT&CK
Rule Metadata
Rule ID
0e0bc253-07ed-43f1-816d-e1b220fe8971
Status
test
Level
high
Type
Detection
Created
Fri Jun 09
Path
rules/windows/image_load/image_load_side_load_rjvplatform_non_default_location.yml
Raw Tags
attack.persistenceattack.defense-evasionattack.privilege-escalationattack.t1574.001