Potential Entra ID PRT Extraction via BrowserCore

[metadata]
creation_date = "2026/09/04"
integration = ["endpoint", "windows", "system", "crowdstrike", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2026/09/18"

[rule]
author = ["Elastic"]
description = """
Identifies anomalous execution of BrowserCore.exe, the Windows component used by Chromium-based browsers for native
messaging with the Web Account Manager (WAM). Adversaries abuse BrowserCore to extract Entra ID Primary Refresh Tokens
(PRTs) without interactive browser context, enabling session hijacking. Legitimate BrowserCore launches carry a
chrome-extension:// argument from the browser native-messaging host.
"""
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Potential Entra ID PRT Extraction via BrowserCore"
references = [
    "https://www.armadin.com/blog-posts/prtremote-extract-prt-cookies-remotely-with-interactivetoken-scheduled-task",
    "https://github.com/dmcxblue/ANIMO/blob/master/helpers/scripts/GrabTokenAzureAD/PrtExtractor.cs",
    "https://attack.mitre.org/techniques/T1528/",
]
risk_score = 73
rule_id = "8f44478a-5b6a-4463-8a0a-3300bf3a62c9"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Platform: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
    "Rule Type: ES|QL",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Windows Security Event Logs",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Data Source: Microsoft Defender XDR",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-sentinel_one_cloud_funnel.*, logs-m365_defender.event-* metadata _id, _version, _index
| where KQL(""" event.category : "process" and event.type : "start" and host.os.type : "windows" """) and 
        to_lower(process.name) == "browsercore.exe" and process.parent.name is not null and process.command_line is not null and
        not to_lower(process.command_line) like "*chrome-extension://*"
| keep
    @timestamp, 
    _id, 
    _version, 
    _index,
    data_stream.namespace,
    host.id,
    host.name,
    user.name,
    user.id,
    process.entity_id,
    process.name,
    process.executable,
    process.command_line,
    process.pe.original_file_name,
    process.parent.name,
    process.parent.executable,
    process.parent.command_line
'''

note = """## Triage and analysis

### Investigating Potential Entra ID PRT Extraction via BrowserCore

BrowserCore.exe is the Chromium native-messaging helper that brokers Web Account Manager (WAM) / Entra ID token
operations for Edge and Chrome. Tools such as PRTRemote and PrtExtractor invoke it outside the browser's
native-messaging context to obtain Primary Refresh Tokens (PRTs).

#### Possible investigation steps

- Is BrowserCore running from a non-canonical path or with a mismatched original filename?
  - Focus: `process.executable`, `process.name`, `process.pe.original_file_name`, `process.hash.sha256`, and signer fields.
  - Implication: escalate when the PE original name is BrowserCore.exe but the path is outside
    `C:\\Windows\\BrowserCore\\`, or when the binary is recently dropped/renamed.

- Does the command line lack the browser native-messaging extension URI?
  - Focus: `process.command_line`, `process.parent.name`, `process.parent.executable`, `process.parent.command_line`.
  - Hint: legitimate launches include `chrome-extension://`. Abuse often omits that URI and may be launched by Task
    Scheduler, scripts, or remote tools.
  - Implication: escalate when `chrome-extension://` is absent and the parent is `svchost.exe` (task), `powershell.exe`,
    `wscript.exe`, or another unexpected launcher.

- Was there related token theft or Entra ID activity around the same time?
  - Focus: related alerts for `user.id` / `host.id` covering credential access, unusual logons, or cloud session abuse.
  - Implication: broaden scope when PRT extraction coincides with suspicious Azure/Entra sign-ins or cookie theft.

### False positive analysis

- Legitimate browser SSO and account linking launch BrowserCore with a `chrome-extension://` argument and should not
  match pivot 2. Rare custom helpers that invoke BrowserCore without that URI may need exceptions scoped to
  `process.executable`, `process.parent.executable`, `user.id`, and `host.id`.

### Response and remediation

- If confirmed malicious, isolate the host, terminate the anomalous BrowserCore tree, and assume the user's Entra ID
  PRT/session may be compromised: revoke refresh tokens / sign the user out of all sessions and rotate credentials.
- Hunt for the same `process.command_line` pattern, scheduled tasks, or scripts that invoke BrowserCore across the estate.
- Remove persistence (scheduled tasks, scripts) that launched BrowserCore outside the browser native-messaging flow.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "user.name",
    "user.id",
    "process.entity_id",
    "process.name",
    "process.executable",
    "process.command_line",
    "process.pe.original_file_name",
    "process.parent.name",
    "process.parent.executable",
    "process.parent.command_line",
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[[rule.threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"