Potential DLL Sideloading Via DeviceEnroller.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

Detects the use of the PhoneDeepLink parameter with DeviceEnroller.exe to potentially sideload a non-existent DLL file named "ShellChromeAPI.dll". Adversaries can leverage this technique by dropping their own renamed malicious DLL and executing it via DeviceEnroller.exe using this parameter.