Potential Entra ID PRT Extraction via BrowserCore

Description

Identifies anomalous execution of BrowserCore.exe, the Windows component used by Chromium-based browsers for native messaging with the Web Account Manager (WAM). Adversaries abuse BrowserCore to extract Entra ID Primary Refresh Tokens (PRTs) without interactive browser context, enabling session hijacking. Legitimate BrowserCore launches carry a chrome-extension:// argument from the browser native-messaging host.

Query · esql

from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-sentinel_one_cloud_funnel.*, logs-m365_defender.event-* metadata _id, _version, _index
| where KQL(""" event.category : "process" and event.type : "start" and host.os.type : "windows" """) and 
        to_lower(process.name) == "browsercore.exe" and process.parent.name is not null and process.command_line is not null and
        not to_lower(process.command_line) like "*chrome-extension://*"
| keep
    @timestamp, 
    _id, 
    _version, 
    _index,
    data_stream.namespace,
    host.id,
    host.name,
    user.name,
    user.id,
    process.entity_id,
    process.name,
    process.executable,
    process.command_line,
    process.pe.original_file_name,
    process.parent.name,
    process.parent.executable,
    process.parent.command_line

Investigation fields

Pivot points the source recommends for triage.

  • @timestamp
  • host.id
  • host.name
  • user.name
  • user.id
  • process.entity_id
  • process.name
  • process.executable
  • process.command_line
  • process.pe.original_file_name
  • process.parent.name
  • process.parent.executable
  • process.parent.command_line

Implementation guide

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

Analyst notes

Investigating Potential Entra ID PRT Extraction via BrowserCore

BrowserCore.exe is the Chromium native-messaging helper that brokers Web Account Manager (WAM) / Entra ID token operations for Edge and Chrome. Tools such as PRTRemote and PrtExtractor invoke it outside the browser's native-messaging context to obtain Primary Refresh Tokens (PRTs).

Possible investigation steps

  • Is BrowserCore running from a non-canonical path or with a mismatched original filename?
  • Focus: process.executable, process.name, process.pe.original_file_name, process.hash.sha256, and signer fields.

  • Implication: escalate when the PE original name is BrowserCore.exe but the path is outside C:\Windows\BrowserCore\, or when the binary is recently dropped/renamed.

  • Does the command line lack the browser native-messaging extension URI?

  • Focus: process.command_line, process.parent.name, process.parent.executable, process.parent.command_line.
  • Hint: legitimate launches include chrome-extension://. Abuse often omits that URI and may be launched by Task Scheduler, scripts, or remote tools.

  • Implication: escalate when chrome-extension:// is absent and the parent is svchost.exe (task), powershell.exe, wscript.exe, or another unexpected launcher.

  • Was there related token theft or Entra ID activity around the same time?

  • Focus: related alerts for user.id / host.id covering credential access, unusual logons, or cloud session abuse.
  • Implication: broaden scope when PRT extraction coincides with suspicious Azure/Entra sign-ins or cookie theft.

False positive analysis

  • Legitimate browser SSO and account linking launch BrowserCore with a chrome-extension:// argument and should not match pivot 2. Rare custom helpers that invoke BrowserCore without that URI may need exceptions scoped to process.executable, process.parent.executable, user.id, and host.id.

Response and remediation

  • If confirmed malicious, isolate the host, terminate the anomalous BrowserCore tree, and assume the user's Entra ID PRT/session may be compromised: revoke refresh tokens / sign the user out of all sessions and rotate credentials.
  • Hunt for the same process.command_line pattern, scheduled tasks, or scripts that invoke BrowserCore across the estate.
  • Remove persistence (scheduled tasks, scripts) that launched BrowserCore outside the browser native-messaging flow.
Raw source Potential Entra ID PRT Extraction via BrowserCore · Elastic TOML
Esc
Published by elastic/detection-rules ↗, licensed under Elastic License 2.0 ↗. Reproduced here unmodified. 
[metadata]
creation_date = "2026/09/04"
integration = ["endpoint", "windows", "system", "crowdstrike", "sentinel_one_cloud_funnel", "m365_defender"]
maturity = "production"
updated_date = "2026/09/04"

[rule]
author = ["Elastic"]
description = """
Identifies anomalous execution of BrowserCore.exe, the Windows component used by Chromium-based browsers for native
messaging with the Web Account Manager (WAM). Adversaries abuse BrowserCore to extract Entra ID Primary Refresh Tokens
(PRTs) without interactive browser context, enabling session hijacking. Legitimate BrowserCore launches carry a
chrome-extension:// argument from the browser native-messaging host.
"""
from = "now-9m"
language = "esql"
license = "Elastic License v2"
name = "Potential Entra ID PRT Extraction via BrowserCore"
references = [
    "https://www.armadin.com/blog-posts/prtremote-extract-prt-cookies-remotely-with-interactivetoken-scheduled-task",
    "https://github.com/dmcxblue/ANIMO/blob/master/helpers/scripts/GrabTokenAzureAD/PrtExtractor.cs",
    "https://attack.mitre.org/techniques/T1528/",
]
risk_score = 73
rule_id = "8f44478a-5b6a-4463-8a0a-3300bf3a62c9"
severity = "high"
tags = [
    "Domain: Endpoint",
    "OS: Windows",
    "Platform: Windows",
    "Use Case: Threat Detection",
    "Tactic: Credential Access",
    "Resources: Investigation Guide",
    "Rule Type: ESQL",
    "Data Source: Elastic Defend",
    "Data Source: Sysmon",
    "Data Source: Windows Security Event Logs",
    "Data Source: Crowdstrike",
    "Data Source: SentinelOne",
    "Data Source: Microsoft Defender XDR",
]
timestamp_override = "event.ingested"
type = "esql"

query = '''
from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-sentinel_one_cloud_funnel.*, logs-m365_defender.event-* metadata _id, _version, _index
| where KQL(""" event.category : "process" and event.type : "start" and host.os.type : "windows" """) and 
        to_lower(process.name) == "browsercore.exe" and process.parent.name is not null and process.command_line is not null and
        not to_lower(process.command_line) like "*chrome-extension://*"
| keep
    @timestamp, 
    _id, 
    _version, 
    _index,
    data_stream.namespace,
    host.id,
    host.name,
    user.name,
    user.id,
    process.entity_id,
    process.name,
    process.executable,
    process.command_line,
    process.pe.original_file_name,
    process.parent.name,
    process.parent.executable,
    process.parent.command_line
'''

note = """## Triage and analysis

### Investigating Potential Entra ID PRT Extraction via BrowserCore

BrowserCore.exe is the Chromium native-messaging helper that brokers Web Account Manager (WAM) / Entra ID token
operations for Edge and Chrome. Tools such as PRTRemote and PrtExtractor invoke it outside the browser's
native-messaging context to obtain Primary Refresh Tokens (PRTs).

#### Possible investigation steps

- Is BrowserCore running from a non-canonical path or with a mismatched original filename?
  - Focus: `process.executable`, `process.name`, `process.pe.original_file_name`, `process.hash.sha256`, and signer fields.
  - Implication: escalate when the PE original name is BrowserCore.exe but the path is outside
    `C:\\Windows\\BrowserCore\\`, or when the binary is recently dropped/renamed.

- Does the command line lack the browser native-messaging extension URI?
  - Focus: `process.command_line`, `process.parent.name`, `process.parent.executable`, `process.parent.command_line`.
  - Hint: legitimate launches include `chrome-extension://`. Abuse often omits that URI and may be launched by Task
    Scheduler, scripts, or remote tools.
  - Implication: escalate when `chrome-extension://` is absent and the parent is `svchost.exe` (task), `powershell.exe`,
    `wscript.exe`, or another unexpected launcher.

- Was there related token theft or Entra ID activity around the same time?
  - Focus: related alerts for `user.id` / `host.id` covering credential access, unusual logons, or cloud session abuse.
  - Implication: broaden scope when PRT extraction coincides with suspicious Azure/Entra sign-ins or cookie theft.

### False positive analysis

- Legitimate browser SSO and account linking launch BrowserCore with a `chrome-extension://` argument and should not
  match pivot 2. Rare custom helpers that invoke BrowserCore without that URI may need exceptions scoped to
  `process.executable`, `process.parent.executable`, `user.id`, and `host.id`.

### Response and remediation

- If confirmed malicious, isolate the host, terminate the anomalous BrowserCore tree, and assume the user's Entra ID
  PRT/session may be compromised: revoke refresh tokens / sign the user out of all sessions and rotate credentials.
- Hunt for the same `process.command_line` pattern, scheduled tasks, or scripts that invoke BrowserCore across the estate.
- Remove persistence (scheduled tasks, scripts) that launched BrowserCore outside the browser native-messaging flow.
"""

setup = """## Setup

This rule is designed for data generated by [Elastic Defend](https://www.elastic.co/security/endpoint-security), which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

### Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

- [CrowdStrike](https://ela.st/crowdstrike-integration)
- [Microsoft Defender XDR](https://ela.st/m365-defender)
- [SentinelOne Cloud Funnel](https://ela.st/sentinel-one-cloud-funnel)
- [Sysmon Event ID 1 - Process Creation](https://ela.st/sysmon-event-1-setup)
- [Windows Process Creation Logs](https://ela.st/audit-process-creation)
"""

[rule.investigation_fields]
field_names = [
    "@timestamp",
    "host.id",
    "host.name",
    "user.name",
    "user.id",
    "process.entity_id",
    "process.name",
    "process.executable",
    "process.command_line",
    "process.pe.original_file_name",
    "process.parent.name",
    "process.parent.executable",
    "process.parent.command_line",
]

[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[[rule.threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"

[rule.threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.