DLL Sideloading Of ShellChromeAPI.DLL (ee4c5d06-3abc-48cc-8885-77f1c20f4451)
Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL. Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter