Windows Image Load: MicrosoftAccountTokenProvider.dll Linked to Azure Browser SSO OAuth Token Requests

title: "Windows Image Load: MicrosoftAccountTokenProvider.dll Linked to Azure Browser SSO OAuth Token Requests"
id: 1290b3a9-e0e6-4c3a-baab-8dd99684209a
status: test
description: This rule flags a DLL load event for C:\Windows\System32\MicrosoftAccountTokenProvider.dll, excluding cases where common BackgroundTaskHost, developer tools, browsers, Edge components, and OneDrive executables are involved. Since this component participates in Azure AD browser SSO flows, an attacker can leverage token-related behavior to authenticate to Azure AD from the browser as the Azure-AD-authenticated Windows user. Telemetry required is Windows image/DLL load events that include the loaded DLL path and the loading process image path, enabling the rule’s include/exclude logic.
references:
  - https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml
author: Den Iuzvyk, Huntrule Team
date: 2020-07-15
modified: 2023-04-18
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded: C:\Windows\System32\MicrosoftAccountTokenProvider.dll
  filter_main_bgtaskhost:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
    Image|endswith: \BackgroundTaskHost.exe
  filter_optional_devenv:
    Image|startswith:
      - C:\Program Files\Microsoft Visual Studio\
      - C:\Program Files (x86)\Microsoft Visual Studio\
    Image|endswith: \IDE\devenv.exe
  filter_optional_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_optional_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_optional_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_onedrive:
    Image|endswith: \AppData\Local\Microsoft\OneDrive\OneDrive.exe
  filter_optional_null:
    Image: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - False positives are expected since this rules is only looking for the DLL load event. This rule is better used in correlation with related activity
level: low
license: DRL-1.1
related:
  - id: 50f852e6-af22-4c78-9ede-42ef36aa3453
    type: derived