huntrule

Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft

Flags renamed BrowserCore.exe executions by matching OriginalFileName while the process image ends with BrowserCore.exe.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Max Altgelt (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-02
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion → Cred Access

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

Identifies Windows process creation where the executable is launched as a renamed file but retains the OriginalFileName of BrowserCore.exe. This matters because attackers may masquerade as a legitimate browser component to extract authentication material, such as Azure tokens, while evading simplistic filename-based detections. The rule relies on process creation telemetry that includes both OriginalFileName and the Image path for the executed binary.

Reporting behind it

Related detections9 linkedT1528 — drag to rearrange
Suspicious Renamed Tunneling Tool Executing from Windows Tasks Directory
Suspicious Microsoft Entra Device Code Authentication Flow
Suspicious Renamed PowerShell Binary Execution (via process_creation)
Possible DarkGate Process Injection via iTunesHelper Spawning vbc.exe
Suspicious Renamed PowerShell Copied from System32 via Batch Loader
Suspicious Google Workspace OAuth Authorization for Chrome Web Store Scope via Token Audit
Suspicious OAuth Application Consent Grant via Azure Audit Logs
Suspicious OAuth Application Consent Granted High Privilege Mail Scopes (via m365)
Suspicious Token Request Using Microsoft Authentication Broker Client to Obtain Primary Refresh Token (via azure)
Windows Process Creation: BrowserCore.exe Renamed Execution for Azure Token Theft
Pivot detection · T1528 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.