Windows DLL Load Indicates Potential Azure Browser SSO OAuth Token Request Abuse

Alerts on MicrosoftAccountTokenProvider.dll loads on Windows, with process-based exclusions, as a signal for potential Azure Browser SSO token activity.

FreeReviewedSigma · Low · v2

Product: windows
Category: image_load
Author: Den Iuzvyk (SigmaHQ), DRL 1.1
Published: 2020-07-15
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies cases where MicrosoftAccountTokenProvider.dll is loaded, excluding common benign BackgroundTaskHost.exe and developer/browser host processes. Such a DLL load can be consistent with browser SSO behavior that requests OAuth 2.0 refresh tokens for Azure AD–authenticated users, which an attacker could abuse to authenticate in a browser as that user. The detection relies on Windows image-load telemetry capturing the DLL path, along with process path conditions to reduce straightforward false positives.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious Service DLL Hijack of IKEEXT or PrintNotify

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

Suspicious msimg32.dll Loaded from Non-System Directory

DLL Side-Loading via Signed Binary Loading Known Malicious Helper DLL

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Windows DLL Load Indicates Potential Azure Browser SSO OAuth Token Request Abuse

Pivot detection · T1574.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-image-load-microsoftaccounttokenprovider-dll-linked-to-azure-browser-sso-50f852e6

title: Windows DLL Load Indicates Potential Azure Browser SSO OAuth Token Request Abuse
id: 1290b3a9-e0e6-4c3a-baab-8dd99684209a
status: test
description: This rule identifies cases where MicrosoftAccountTokenProvider.dll is loaded, excluding common benign BackgroundTaskHost.exe and developer/browser host processes. Such a DLL load can be consistent with browser SSO behavior that requests OAuth 2.0 refresh tokens for Azure AD–authenticated users, which an attacker could abuse to authenticate in a browser as that user. The detection relies on Windows image-load telemetry capturing the DLL path, along with process path conditions to reduce straightforward false positives.
references:
  - https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml
author: Den Iuzvyk, Huntrule Team
date: 2020-07-15
modified: 2023-04-18
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded: C:\Windows\System32\MicrosoftAccountTokenProvider.dll
  filter_main_bgtaskhost:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
    Image|endswith: \BackgroundTaskHost.exe
  filter_optional_devenv:
    Image|startswith:
      - C:\Program Files\Microsoft Visual Studio\
      - C:\Program Files (x86)\Microsoft Visual Studio\
    Image|endswith: \IDE\devenv.exe
  filter_optional_ie:
    Image:
      - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      - C:\Program Files\Internet Explorer\iexplore.exe
  filter_optional_edge_1:
    - Image|startswith: C:\Program Files (x86)\Microsoft\EdgeWebView\Application\
    - Image|endswith: \WindowsApps\MicrosoftEdge.exe
    - Image:
        - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        - C:\Program Files\Microsoft\Edge\Application\msedge.exe
  filter_optional_edge_2:
    Image|startswith:
      - C:\Program Files (x86)\Microsoft\EdgeCore\
      - C:\Program Files\Microsoft\EdgeCore\
    Image|endswith:
      - \msedge.exe
      - \msedgewebview2.exe
  filter_optional_onedrive:
    Image|endswith: \AppData\Local\Microsoft\OneDrive\OneDrive.exe
  filter_optional_null:
    Image: null
  condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
  - False positives are expected since this rules is only looking for the DLL load event. This rule is better used in correlation with related activity
level: low
license: DRL-1.1
related:
  - id: 50f852e6-af22-4c78-9ede-42ef36aa3453
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL