Windows DLL Load Indicates Potential Azure Browser SSO OAuth Token Request Abuse
Alerts on MicrosoftAccountTokenProvider.dll loads on Windows, with process-based exclusions, as a signal for potential Azure Browser SSO token activity.
- Product
- windows
- Category
- image_load
- Author
- Den Iuzvyk (SigmaHQ), DRL 1.1
- Published
- 2020-07-15
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies cases where MicrosoftAccountTokenProvider.dll is loaded, excluding common benign BackgroundTaskHost.exe and developer/browser host processes. Such a DLL load can be consistent with browser SSO behavior that requests OAuth 2.0 refresh tokens for Azure AD–authenticated users, which an attacker could abuse to authenticate in a browser as that user. The detection relies on Windows image-load telemetry capturing the DLL path, along with process path conditions to reduce straightforward false positives.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows DLL Load Indicates Potential Azure Browser SSO OAuth Token Request Abuse
id: 1290b3a9-e0e6-4c3a-baab-8dd99684209a
status: test
description: This rule identifies cases where MicrosoftAccountTokenProvider.dll is loaded, excluding common benign BackgroundTaskHost.exe and developer/browser host processes. Such a DLL load can be consistent with browser SSO behavior that requests OAuth 2.0 refresh tokens for Azure AD–authenticated users, which an attacker could abuse to authenticate in a browser as that user. The detection relies on Windows image-load telemetry capturing the DLL path, along with process path conditions to reduce straightforward false positives.
references:
- https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml
author: Den Iuzvyk, Huntrule Team
date: 2020-07-15
modified: 2023-04-18
tags:
- attack.persistence
- attack.privilege-escalation
- attack.execution
- attack.stealth
- attack.t1574.001
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded: C:\Windows\System32\MicrosoftAccountTokenProvider.dll
filter_main_bgtaskhost:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
Image|endswith: \BackgroundTaskHost.exe
filter_optional_devenv:
Image|startswith:
- C:\Program Files\Microsoft Visual Studio\
- C:\Program Files (x86)\Microsoft Visual Studio\
Image|endswith: \IDE\devenv.exe
filter_optional_ie:
Image:
- C:\Program Files (x86)\Internet Explorer\iexplore.exe
- C:\Program Files\Internet Explorer\iexplore.exe
filter_optional_edge_1:
- Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
- Image|endswith: \WindowsApps\MicrosoftEdge.exe
- Image:
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- C:\Program Files\Microsoft\Edge\Application\msedge.exe
filter_optional_edge_2:
Image|startswith:
- C:\Program Files (x86)\Microsoft\EdgeCore\
- C:\Program Files\Microsoft\EdgeCore\
Image|endswith:
- \msedge.exe
- \msedgewebview2.exe
filter_optional_onedrive:
Image|endswith: \AppData\Local\Microsoft\OneDrive\OneDrive.exe
filter_optional_null:
Image: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
- False positives are expected since this rules is only looking for the DLL load event. This rule is better used in correlation with related activity
level: low
license: DRL-1.1
related:
- id: 50f852e6-af22-4c78-9ede-42ef36aa3453
type: derived