Potential Entra ID PRT Extraction via BrowserCore

  1[metadata]
  2creation_date = "2026/09/04"
  3integration = ["endpoint", "windows", "system", "crowdstrike", "sentinel_one_cloud_funnel", "m365_defender"]
  4maturity = "production"
  5updated_date = "2026/09/04"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies anomalous execution of BrowserCore.exe, the Windows component used by Chromium-based browsers for native
 11messaging with the Web Account Manager (WAM). Adversaries abuse BrowserCore to extract Entra ID Primary Refresh Tokens
 12(PRTs) without interactive browser context, enabling session hijacking. Legitimate BrowserCore launches carry a
 13chrome-extension:// argument from the browser native-messaging host.
 14"""
 15from = "now-9m"
 16language = "esql"
 17license = "Elastic License v2"
 18name = "Potential Entra ID PRT Extraction via BrowserCore"
 19references = [
 20    "https://www.armadin.com/blog-posts/prtremote-extract-prt-cookies-remotely-with-interactivetoken-scheduled-task",
 21    "https://github.com/dmcxblue/ANIMO/blob/master/helpers/scripts/GrabTokenAzureAD/PrtExtractor.cs",
 22    "https://attack.mitre.org/techniques/T1528/",
 23]
 24risk_score = 73
 25rule_id = "8f44478a-5b6a-4463-8a0a-3300bf3a62c9"
 26severity = "high"
 27tags = [
 28    "Domain: Endpoint",
 29    "OS: Windows",
 30    "Platform: Windows",
 31    "Use Case: Threat Detection",
 32    "Tactic: Credential Access",
 33    "Resources: Investigation Guide",
 34    "Rule Type: ESQL",
 35    "Data Source: Elastic Defend",
 36    "Data Source: Sysmon",
 37    "Data Source: Windows Security Event Logs",
 38    "Data Source: Crowdstrike",
 39    "Data Source: SentinelOne",
 40    "Data Source: Microsoft Defender XDR",
 41]
 42timestamp_override = "event.ingested"
 43type = "esql"
 44
 45query = '''
 46from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-sentinel_one_cloud_funnel.*, logs-m365_defender.event-* metadata _id, _version, _index
 47| where KQL(""" event.category : "process" and event.type : "start" and host.os.type : "windows" """) and 
 48        to_lower(process.name) == "browsercore.exe" and process.parent.name is not null and process.command_line is not null and
 49        not to_lower(process.command_line) like "*chrome-extension://*"
 50| keep
 51    @timestamp, 
 52    _id, 
 53    _version, 
 54    _index,
 55    data_stream.namespace,
 56    host.id,
 57    host.name,
 58    user.name,
 59    user.id,
 60    process.entity_id,
 61    process.name,
 62    process.executable,
 63    process.command_line,
 64    process.pe.original_file_name,
 65    process.parent.name,
 66    process.parent.executable,
 67    process.parent.command_line
 68'''
 69
 70note = """## Triage and analysis
 71
 72### Investigating Potential Entra ID PRT Extraction via BrowserCore
 73
 74BrowserCore.exe is the Chromium native-messaging helper that brokers Web Account Manager (WAM) / Entra ID token
 75operations for Edge and Chrome. Tools such as PRTRemote and PrtExtractor invoke it outside the browser's
 76native-messaging context to obtain Primary Refresh Tokens (PRTs).
 77
 78#### Possible investigation steps
 79
 80- Is BrowserCore running from a non-canonical path or with a mismatched original filename?
 81  - Focus: `process.executable`, `process.name`, `process.pe.original_file_name`, `process.hash.sha256`, and signer fields.
 82  - Implication: escalate when the PE original name is BrowserCore.exe but the path is outside
 83    `C:\\Windows\\BrowserCore\\`, or when the binary is recently dropped/renamed.
 84
 85- Does the command line lack the browser native-messaging extension URI?
 86  - Focus: `process.command_line`, `process.parent.name`, `process.parent.executable`, `process.parent.command_line`.
 87  - Hint: legitimate launches include `chrome-extension://`. Abuse often omits that URI and may be launched by Task
 88    Scheduler, scripts, or remote tools.
 89  - Implication: escalate when `chrome-extension://` is absent and the parent is `svchost.exe` (task), `powershell.exe`,
 90    `wscript.exe`, or another unexpected launcher.
 91
 92- Was there related token theft or Entra ID activity around the same time?
 93  - Focus: related alerts for `user.id` / `host.id` covering credential access, unusual logons, or cloud session abuse.
 94  - Implication: broaden scope when PRT extraction coincides with suspicious Azure/Entra sign-ins or cookie theft.
 95
 96### False positive analysis
 97
 98- Legitimate browser SSO and account linking launch BrowserCore with a `chrome-extension://` argument and should not
 99  match pivot 2. Rare custom helpers that invoke BrowserCore without that URI may need exceptions scoped to
100  `process.executable`, `process.parent.executable`, `user.id`, and `host.id`.
101
102### Response and remediation
103
104- If confirmed malicious, isolate the host, terminate the anomalous BrowserCore tree, and assume the user's Entra ID
105  PRT/session may be compromised: revoke refresh tokens / sign the user out of all sessions and rotate credentials.
106- Hunt for the same `process.command_line` pattern, scheduled tasks, or scripts that invoke BrowserCore across the estate.
107- Remove persistence (scheduled tasks, scripts) that launched BrowserCore outside the browser native-messaging flow.
108"""
109
110setup = """## Setup
111
112This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.
113
114Setup instructions: https://ela.st/install-elastic-defend
115
116### Additional data sources
117
118This rule also supports the following third-party data sources. For setup instructions, refer to the links below:
119
120- [CrowdStrike](https://ela.st/crowdstrike-integration)
121- [Microsoft Defender XDR](https://ela.st/m365-defender)
122- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
123- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
124- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
125"""
126
127[rule.investigation_fields]
128field_names = [
129    "@timestamp",
130    "host.id",
131    "host.name",
132    "user.name",
133    "user.id",
134    "process.entity_id",
135    "process.name",
136    "process.executable",
137    "process.command_line",
138    "process.pe.original_file_name",
139    "process.parent.name",
140    "process.parent.executable",
141    "process.parent.command_line",
142]
143
144[[rule.threat]]
145framework = "MITRE ATT&CK"
146[[rule.threat.technique]]
147id = "T1528"
148name = "Steal Application Access Token"
149reference = "https://attack.mitre.org/techniques/T1528/"
150
151[[rule.threat.technique]]
152id = "T1539"
153name = "Steal Web Session Cookie"
154reference = "https://attack.mitre.org/techniques/T1539/"
155
156[rule.threat.tactic]
157id = "TA0006"
158name = "Credential Access"
159reference = "https://attack.mitre.org/tactics/TA0006/"