Detectionmediumtest

Potential DLL Sideloading Via DeviceEnroller.EXE

Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll". Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

@gott_cyberCreated Mon Aug 29Updated Sat Feb 04e173ad47-4388-4012-ae62-bd13f71c18a8windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection_img:
        - Image|endswith: '\deviceenroller.exe'
        - OriginalFileName: 'deviceenroller.exe'
    selection_cli:
        CommandLine|contains: '/PhoneDeepLink'
    condition: all of selection_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0004 · Privilege Escalation TA0003 · Persistence TA0005 · Defense Evasion

Sub-techniques

T1574.001 · DLL Search Order Hijacking

Related Rules

SimilarDetectionhigh

DLL Sideloading Of ShellChromeAPI.DLL

Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

e173ad47-4388-4012-ae62-bd13f71c18a8

Status

test

Level

medium

Type

Detection

Created

Mon Aug 29

Modified

Sat Feb 04

Author

@gott_cyber

Path

rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml

Raw Tags

attack.privilege-escalationattack.persistenceattack.defense-evasionattack.t1574.001

View on GitHub