Windows DLL Sidelo ading: Detect Image Loads of ShellChromeAPI.dll

Alerts when Windows processes attempt to load ShellChromeAPI.dll, a DLL typically not present on systems.

FreeUnreviewedSigmahighv1

windows-dll-sidelo-ading-detect-image-loads-of-shellchromeapi-dll-ee4c5d06

title: "Windows DLL Sidelo ading: Detect Image Loads of ShellChromeAPI.dll"
id: e31f7663-0448-4f64-b88e-95c4e1e51d82
related:
  - id: e173ad47-4388-4012-ae62-bd13f71c18a8
    type: similar
  - id: ee4c5d06-3abc-48cc-8885-77f1c20f4451
    type: derived
status: test
description: This rule flags Windows processes that load a non-existent DLL named ShellChromeAPI.dll by matching DLL image load events ending with \ShellChromeAPI.dll. Such behavior is commonly used to coerce a legitimate loader process into attempting to load an attacker-supplied or mispositioned library. The detection relies on telemetry from DLL/image load activity (category image_load) on Windows that records the loaded module path or name.
references:
  - https://mobile.twitter.com/0gtweet/status/1564131230941122561
  - https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_side_load_shell_chrome_api.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-01
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \ShellChromeAPI.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows processes that load a non-existent DLL named ShellChromeAPI.dll by matching DLL image load events ending with \ShellChromeAPI.dll. Such behavior is commonly used to coerce a legitimate loader process into attempting to load an attacker-supplied or mispositioned library. The detection relies on telemetry from DLL/image load activity (category image_load) on Windows that records the loaded module path or name.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.