Elastic high stable kql

Potential Entra ID PRT Extraction via BrowserCore

Identifies anomalous execution of BrowserCore.exe, the Windows component used by Chromium-based browsers for native messaging with the Web Account Manager (WAM). Adversaries abuse BrowserCore to extract Entra ID Primary Refresh Tokens (PRTs) without interactive browser context, enabling session hijacking. Legitimate BrowserCore launches carry a chrome-extension:// argument from the browser native-messaging host.

View Source

Detection Logic

from logs-endpoint.events.process-*, logs-windows.sysmon_operational-*, logs-system.security-*, logs-windows.*, winlogbeat-*, logs-crowdstrike.fdr*, logs-sentinel_one_cloud_funnel.*, logs-m365_defender.event-* metadata _id, _version, _index
| where KQL(""" event.category : "process" and event.type : "start" and host.os.type : "windows" """) and 
        to_lower(process.name) == "browsercore.exe" and process.parent.name is not null and process.command_line is not null and
        not to_lower(process.command_line) like "*chrome-extension://*"
| keep
    @timestamp, 
    _id, 
    _version, 
    _index,
    data_stream.namespace,
    host.id,
    host.name,
    user.name,
    user.id,
    process.entity_id,
    process.name,
    process.executable,
    process.command_line,
    process.pe.original_file_name,
    process.parent.name,
    process.parent.executable,
    process.parent.command_line

Field Validations

Loading…

Comments (0)

Loading comments...