{"id":"e173ad47-4388-4012-ae62-bd13f71c18a8","title":"Potential DLL Sideloading Via DeviceEnroller.EXE","description":"Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named \"ShellChromeAPI.dll\".\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n","author":"@gott_cyber","status":"test","level":"medium","date":"2022-08-29","modified":"2023-02-04","tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://mobile.twitter.com/0gtweet/status/1564131230941122561","https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html"],"source_path":"rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml","source_sha256":"692620a0e078b59491fb2d136e230e66d42f2fa3d758dcaabc164ef7e6bad824","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential DLL Sideloading Via DeviceEnroller.EXE\nid: e173ad47-4388-4012-ae62-bd13f71c18a8\nrelated:\n    - id: ee4c5d06-3abc-48cc-8885-77f1c20f4451\n      type: similar\nstatus: test\ndescription: |\n    Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named \"ShellChromeAPI.dll\".\n    Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\nreferences:\n    - https://mobile.twitter.com/0gtweet/status/1564131230941122561\n    - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html\nauthor: '@gott_cyber'\ndate: 2022-08-29\nmodified: 2023-02-04\ntags:\n    - attack.privilege-escalation\n    - attack.persistence\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith: '\\deviceenroller.exe'\n        - OriginalFileName: 'deviceenroller.exe'\n    selection_cli:\n        CommandLine|contains: '/PhoneDeepLink'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/e173ad47-4388-4012-ae62-bd13f71c18a8.json","kind":"sigma"}