Potential RjvPlatform.DLL Sideloading From Default Location

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary from the "C:\$SysReset\Framework\Stack\" directory. This behavior is suspicious because the "$SysReset" directory is not created by default, suggesting an adversary might be abusing this path for DLL sideloading to achieve persistence, privilege escalation, or defense evasion.