Skip to content
Threat Feed
Subscribe
high advisory

SystemResetPlatform DLL Sideloading

Adversaries may perform DLL sideloading by placing a malicious RjvPlatform.dll in a non-default directory to be loaded by the SystemResetPlatform.exe binary.

Triage facts

Revision 1
Applicability
Windows
Evidence
Unknown
Severity
High
Action
Elevated
Sources
2 public sources
Freshness
Revision 1Nov 5, 12:57 UTC
Detection
1 rule
Source quality
B2Likely

This detection focuses on the unauthorized execution of the RjvPlatform.dll library by the SystemResetPlatform.exe process. DLL sideloading occurs when a legitimate application is tricked into loading a malicious library placed in a non-standard file path, potentially allowing for persistence or privilege escalation. This rule targets instances where the DLL is loaded from locations outside of the legitimate System32 directory path.

Recommendation

Deploy the provided Sigma rule to monitor for image loads of RjvPlatform.dll by SystemResetPlatform.exe occurring from paths outside of C:\Windows\System32\SystemResetPlatform. Investigate any instances where this process is executed from user-writable directories or temporary locations.

Immediate actions

Deploy Sigma rule to monitor SystemResetPlatform.exe image loads

Detection Engineering 48h

Threat Hunt

Identify executions of SystemResetPlatform.exe originating from non-Windows directories

T1574.001 medium high confidence hunt now

Data: Process Creation (Event ID 1)

Detection coverage 1

Detect RjvPlatform.DLL Sideloading From Non-Default Location

high

Detects potential DLL sideloading of RjvPlatform.dll by SystemResetPlatform.exe located in a non-default path.

sigma tactics: execution, persistence, privilege-escalation techniques: T1574.001 sources: image_load, windows

Detection queries are available on the platform. Get full rules →