Potential DLL Sideloading via DeviceEnroller.exe Using /PhoneDeepLink

Alerts on deviceenroller.exe runs with /PhoneDeepLink, a potential DLL sideloading trigger referencing ShellChromeAPI.dll.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: @gott_cyber (SigmaHQ), DRL 1.1
Published: 2022-08-29
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where DeviceEnroller.exe is launched with the /PhoneDeepLink parameter. The matching pattern indicates an execution flow that may attempt DLL sideloading of a non-existent file named ShellChromeAPI.dll. Attackers may use this mechanism to execute attacker-controlled code by arranging a renamed DLL for loading. The detection relies on Windows process creation telemetry, specifically the executable name and command-line contents.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)

Potential DLL Sideloading via DeviceEnroller.exe Using /PhoneDeepLink

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

potential-dll-sideloading-via-deviceenroller-exe-phonedeeplink-parameter-windows-e173ad47

title: Potential DLL Sideloading via DeviceEnroller.exe Using /PhoneDeepLink
id: f2b6a54b-19cc-4dfb-850b-101aa78d66ae
related:
  - id: ee4c5d06-3abc-48cc-8885-77f1c20f4451
    type: similar
  - id: e173ad47-4388-4012-ae62-bd13f71c18a8
    type: derived
status: test
description: This rule flags process creation events where DeviceEnroller.exe is launched with the /PhoneDeepLink parameter. The matching pattern indicates an execution flow that may attempt DLL sideloading of a non-existent file named ShellChromeAPI.dll. Attackers may use this mechanism to execute attacker-controlled code by arranging a renamed DLL for loading. The detection relies on Windows process creation telemetry, specifically the executable name and command-line contents.
references:
  - https://mobile.twitter.com/0gtweet/status/1564131230941122561
  - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml
author: "@gott_cyber, Huntrule Team"
date: 2022-08-29
modified: 2023-02-04
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \deviceenroller.exe
    - OriginalFileName: deviceenroller.exe
  selection_cli:
    CommandLine|contains: /PhoneDeepLink
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL