Potential Entra ID PRT Extraction via BrowserCore

[rule]
description = """
Identifies anomalous execution of BrowserCore.exe, the Windows component used by Chromium-based browsers for native
messaging. Adversaries abuse BrowserCore to extract Primary Refresh Tokens (PRTs) from the Web Account Manager (WAM)
without user interaction, enabling Entra ID session hijacking.
"""
id = "970e26d3-9a1d-474e-b2bf-facc5e1666f9"
license = "Elastic License v2"
name = "Potential Entra ID PRT Extraction via BrowserCore"
os_list = ["windows"]
reference = [
    "https://www.armadin.com/blog-posts/prtremote-extract-prt-cookies-remotely-with-interactivetoken-scheduled-task",
    "https://github.com/dmcxblue/ANIMO/blob/master/helpers/scripts/GrabTokenAzureAD/PrtExtractor.cs",
    "https://attack.mitre.org/techniques/T1528/",
    "https://attack.mitre.org/techniques/T1539/",
]
version = "1.0.1"

query = '''
process where event.action == "start" and process.parent.name != null and 
(
  /* Wrong path - masquerade */
  (
    (process.pe.original_file_name == "BrowserCore.exe" or process.name : "BrowserCore.exe") and
    not process.executable : ("?:\\Windows\\BrowserCore\\BrowserCore.exe", "?:\\Program Files\\Windows Security\\BrowserCore\\BrowserCore.exe")
  )
  or
  /* Anomalous launch context */
  (
    process.name : "BrowserCore.exe" and
    process.executable : ("?:\\Windows\\BrowserCore\\BrowserCore.exe", "?:\\Program Files\\Windows Security\\BrowserCore\\BrowserCore.exe") and
    not (
      process.parent.name : "cmd.exe" and 
      process.parent.command_line : "*chrome-extension*--parent-window=*" and process.command_line : "*chrome-extension*--parent-window=*"
    )
  )
)
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
tree = true

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1528"
name = "Steal Application Access Token"
reference = "https://attack.mitre.org/techniques/T1528/"

[[threat.technique]]
id = "T1539"
name = "Steal Web Session Cookie"
reference = "https://attack.mitre.org/techniques/T1539/"


[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"