{"id":"ee4c5d06-3abc-48cc-8885-77f1c20f4451","title":"DLL Sideloading Of ShellChromeAPI.DLL","description":"Detects processes loading the non-existent DLL \"ShellChromeAPI\". One known example is the \"DeviceEnroller\" binary in combination with the \"PhoneDeepLink\" flag tries to load this DLL.\nAdversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\n","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-01","modified":"","tags":["attack.persistence","attack.privilege-escalation","attack.execution","attack.stealth","attack.t1574.001"],"technique_ids":["T1574.001"],"logsource":{"category":"image_load","product":"windows"},"falsepositives":["Unknown"],"references":["https://mobile.twitter.com/0gtweet/status/1564131230941122561","https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html"],"source_path":"rules/windows/image_load/image_load_side_load_shell_chrome_api.yml","source_sha256":"fe3130d26756bf216256757c473a70ef4f30aeec3387247e47225040c11c37b7","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_side_load_shell_chrome_api.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: DLL Sideloading Of ShellChromeAPI.DLL\nid: ee4c5d06-3abc-48cc-8885-77f1c20f4451\nrelated:\n    - id: e173ad47-4388-4012-ae62-bd13f71c18a8\n      type: similar\nstatus: test\ndescription: |\n    Detects processes loading the non-existent DLL \"ShellChromeAPI\". One known example is the \"DeviceEnroller\" binary in combination with the \"PhoneDeepLink\" flag tries to load this DLL.\n    Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter\nreferences:\n    - https://mobile.twitter.com/0gtweet/status/1564131230941122561\n    - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2022-12-01\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.execution\n    - attack.stealth\n    - attack.t1574.001\nlogsource:\n    category: image_load\n    product: windows\ndetection:\n    selection:\n        # The DLL shouldn't exist on Windows anymore. If for some reason you still have it. You could filter out legitimate calls\n        ImageLoaded|endswith: '\\ShellChromeAPI.dll'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1574.001","id":"T1574.001","name":"DLL","page":"techniques/enterprise/T1574.001/"}],"data_path":"data/detection-rules/ee4c5d06-3abc-48cc-8885-77f1c20f4451.json","kind":"sigma"}