Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft

title: "Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft"
id: 5ec18d4c-09a5-4fcd-b1ed-3b812d3e3106
status: test
description: Identifies Windows process creation where the executable is launched as a renamed file but retains the OriginalFileName of BrowserCore.exe. This matters because attackers may masquerade as a legitimate browser component to extract authentication material, such as Azure tokens, while evading simplistic filename-based detections. The rule relies on process creation telemetry that includes both OriginalFileName and the Image path for the executed binary.
references:
  - https://twitter.com/mariuszbit/status/1531631015139102720
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2022-06-02
modified: 2023-02-03
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1528
  - attack.t1036.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName: BrowserCore.exe
  filter_realbrowsercore:
    Image|endswith: \BrowserCore.exe
  condition: selection and not 1 of filter_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8a4519e8-e64a-40b6-ae85-ba8ad2177559
    type: derived