Potential RjvPlatform.DLL Sideloading From Default Location

Title: Potential RjvPlatform.DLL Sideloading From Default Location
Status: test
Description:Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.
References:
  -https://twitter.com/0gtweet/status/1666716511988330499
Author: X__Junior (Nextron Systems)
Date: 2023-06-09
modified:None
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    Image: 'C:\Windows\System32\SystemResetPlatform\SystemResetPlatform.exe'
    ImageLoaded: 'C:\$SysReset\Framework\Stack\RjvPlatform.dll'
  condition:selection
Falsepositives:
  -Unknown
Level: medium