huntrule

Potential DLL Sideloading via DeviceEnroller.exe /PhoneDeepLink Parameter (Windows)

Alerts on deviceenroller.exe runs with /PhoneDeepLink, a potential DLL sideloading trigger referencing ShellChromeAPI.dll.

FreeUnreviewedSigmamediumv1
title: Potential DLL Sideloading via DeviceEnroller.exe /PhoneDeepLink Parameter (Windows)
id: f2b6a54b-19cc-4dfb-850b-101aa78d66ae
related:
  - id: ee4c5d06-3abc-48cc-8885-77f1c20f4451
    type: similar
  - id: e173ad47-4388-4012-ae62-bd13f71c18a8
    type: derived
status: test
description: This rule flags process creation where deviceenroller.exe is launched with the /PhoneDeepLink parameter. The intent is to trigger DLL loading behavior that may reference a missing DLL named "ShellChromeAPI.dll". This matters because attackers may leverage this execution path to load a attacker-controlled or renamed DLL, enabling stealthy persistence or execution. Telemetry relies on Windows process creation fields including image name and command line contents.
references:
  - https://mobile.twitter.com/0gtweet/status/1564131230941122561
  - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml
author: "@gott_cyber, Huntrule Team"
date: 2022-08-29
modified: 2023-02-04
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \deviceenroller.exe
    - OriginalFileName: deviceenroller.exe
  selection_cli:
    CommandLine|contains: /PhoneDeepLink
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags process creation where deviceenroller.exe is launched with the /PhoneDeepLink parameter. The intent is to trigger DLL loading behavior that may reference a missing DLL named "ShellChromeAPI.dll". This matters because attackers may leverage this execution path to load a attacker-controlled or renamed DLL, enabling stealthy persistence or execution. Telemetry relies on Windows process creation fields including image name and command line contents.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.