Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft
Flags renamed BrowserCore.exe executions by matching OriginalFileName while the process image ends with BrowserCore.exe.
- Product
- windows
- Category
- process_creation
- Author
- Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-06-02
- Updated
- 2026-07-30
ATT&CK techniques
Defense Evasion → Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
Identifies Windows process creation where the executable is launched as a renamed file but retains the OriginalFileName of BrowserCore.exe. This matters because attackers may masquerade as a legitimate browser component to extract authentication material, such as Azure tokens, while evading simplistic filename-based detections. The rule relies on process creation telemetry that includes both OriginalFileName and the Image path for the executed binary.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft"
id: 5ec18d4c-09a5-4fcd-b1ed-3b812d3e3106
status: test
description: Identifies Windows process creation where the executable is launched as a renamed file but retains the OriginalFileName of BrowserCore.exe. This matters because attackers may masquerade as a legitimate browser component to extract authentication material, such as Azure tokens, while evading simplistic filename-based detections. The rule relies on process creation telemetry that includes both OriginalFileName and the Image path for the executed binary.
references:
- https://twitter.com/mariuszbit/status/1531631015139102720
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml
author: Max Altgelt (Nextron Systems), Huntrule Team
date: 2022-06-02
modified: 2023-02-03
tags:
- attack.credential-access
- attack.stealth
- attack.t1528
- attack.t1036.003
logsource:
category: process_creation
product: windows
detection:
selection:
OriginalFileName: BrowserCore.exe
filter_realbrowsercore:
Image|endswith: \BrowserCore.exe
condition: selection and not 1 of filter_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 8a4519e8-e64a-40b6-ae85-ba8ad2177559
type: derived