1200KM / sigma-rule
DLL Sideloading Of ShellChromeAPI.DLL — Sigma Rule
Sigma rule ee4c5d06-3abc-48cc-8885-77f1c20f4451. DLL Sideloading Of ShellChromeAPI.DLL — Sigma Rule. Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Rule metadata and linked tags
Author: Nasreddine Bencherchali (Nextron Systems). Source status: test; severity: high. Source dates: 2022-12-01 / not supplied.
{
"category": "image_load",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: fe3130d26756bf216256757c473a70ef4f30aeec3387247e47225040c11c37b7
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: DLL Sideloading Of ShellChromeAPI.DLL
id: ee4c5d06-3abc-48cc-8885-77f1c20f4451
related:
- id: e173ad47-4388-4012-ae62-bd13f71c18a8
type: similar
status: test
description: |
Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL.
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
references:
- https://mobile.twitter.com/0gtweet/status/1564131230941122561
- https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html
author: Nasreddine Bencherchali (Nextron Systems)
date: 2022-12-01
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
# The DLL shouldn't exist on Windows anymore. If for some reason you still have it. You could filter out legitimate calls
ImageLoaded|endswith: '\ShellChromeAPI.dll'
condition: selection
falsepositives:
- Unknown
level: high
False positives
- Unknown
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.