« Potential EDR-Freeze via WerFaultSecure Abuse Potential Enumeration via Active Directory Web Service »
Elastic Docs ›Elastic Security [8.19] ›Detections and alerts ›Prebuilt rule reference

Potential Entra ID PRT Extraction via BrowserCore

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

Potential Entra ID PRT Extraction via BrowserCore

edit

Identifies anomalous execution of BrowserCore.exe, the Windows component used by Chromium-based browsers for native messaging with the Web Account Manager (WAM). Adversaries abuse BrowserCore to extract Entra ID Primary Refresh Tokens (PRTs) without interactive browser context, enabling session hijacking. Legitimate BrowserCore launches carry a chrome-extension:// argument from the browser native-messaging host.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: Endpoint
  • OS: Windows
  • Platform: Windows
  • Use Case: Threat Detection
  • Tactic: Credential Access
  • Resources: Investigation Guide
  • Rule Type: ESQL
  • Data Source: Elastic Defend
  • Data Source: Sysmon
  • Data Source: Windows Security Event Logs
  • Data Source: Crowdstrike
  • Data Source: SentinelOne
  • Data Source: Microsoft Defender XDR

Version: 2

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating Potential Entra ID PRT Extraction via BrowserCore

BrowserCore.exe is the Chromium native-messaging helper that brokers Web Account Manager (WAM) / Entra ID token operations for Edge and Chrome. Tools such as PRTRemote and PrtExtractor invoke it outside the browser’s native-messaging context to obtain Primary Refresh Tokens (PRTs).

Possible investigation steps

  • Is BrowserCore running from a non-canonical path or with a mismatched original filename?
  • Focus: process.executable, process.name, process.pe.original_file_name, process.hash.sha256, and signer fields.
  • Implication: escalate when the PE original name is BrowserCore.exe but the path is outside C:\Windows\BrowserCore\, or when the binary is recently dropped/renamed.
  • Does the command line lack the browser native-messaging extension URI?
  • Focus: process.command_line, process.parent.name, process.parent.executable, process.parent.command_line.
  • Hint: legitimate launches include chrome-extension://. Abuse often omits that URI and may be launched by Task Scheduler, scripts, or remote tools.
  • Implication: escalate when chrome-extension:// is absent and the parent is svchost.exe (task), powershell.exe, wscript.exe, or another unexpected launcher.
  • Was there related token theft or Entra ID activity around the same time?
  • Focus: related alerts for user.id / host.id covering credential access, unusual logons, or cloud session abuse.
  • Implication: broaden scope when PRT extraction coincides with suspicious Azure/Entra sign-ins or cookie theft.

False positive analysis

  • Legitimate browser SSO and account linking launch BrowserCore with a chrome-extension:// argument and should not match pivot 2. Rare custom helpers that invoke BrowserCore without that URI may need exceptions scoped to process.executable, process.parent.executable, user.id, and host.id.

Response and remediation

  • If confirmed malicious, isolate the host, terminate the anomalous BrowserCore tree, and assume the user’s Entra ID PRT/session may be compromised: revoke refresh tokens / sign the user out of all sessions and rotate credentials.
  • Hunt for the same process.command_line pattern, scheduled tasks, or scripts that invoke BrowserCore across the estate.
  • Remove persistence (scheduled tasks, scripts) that launched BrowserCore outside the browser native-messaging flow.

Setup

edit

Setup

This rule is designed for data generated by Elastic Defend, which provides native endpoint detection and response, along with event enrichments designed to work with our detection rules.

Setup instructions: https://ela.st/install-elastic-defend

Additional data sources

This rule also supports the following third-party data sources. For setup instructions, refer to the links below:

Rule query

edit
from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-sentinel_one_cloud_funnel.*, logs-m365_defender.event-* metadata _id, _version, _index
| where KQL(""" event.category : "process" and event.type : "start" and host.os.type : "windows" """) and
        to_lower(process.name) == "browsercore.exe" and process.parent.name is not null and process.command_line is not null and
        not to_lower(process.command_line) like "*chrome-extension://*"
| keep
    @timestamp,
    _id,
    _version,
    _index,
    data_stream.namespace,
    host.id,
    host.name,
    user.name,
    user.id,
    process.entity_id,
    process.name,
    process.executable,
    process.command_line,
    process.pe.original_file_name,
    process.parent.name,
    process.parent.executable,
    process.parent.command_line

Framework: MITRE ATT&CKTM

« Potential EDR-Freeze via WerFaultSecure Abuse Potential Enumeration via Active Directory Web Service »