feat: Add rule for renamed browser core execution

SavinSpring · Jun 2, 2022 · d849ece · d849ece
1 parent a425509
commit d849ece
Showing 1 changed file with 23 additions and 0 deletions.
diff --git a/rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml b/rules/windows/process_creation/proc_creation_win_renamed_browsercore.yml
@@ -0,0 +1,23 @@
+title: Process Creation with Renamed BrowserCore.exe
+id: 8a4519e8-e64a-40b6-ae85-ba8ad2177559
+status: experimental
+description: Detects process creation with a renamed BrowserCore.exe (used to extract Azure tokens)
+author: Max Altgelt
+date: 2022/06/02
+references:
+   - https://twitter.com/mariuszbit/status/1531631015139102720
+tags:
+   - attack.t1528
+   - attack.t1036.003
+logsource:
+   category: process_creation
+   product: windows
+detection:
+   selection:
+      OriginalFileName: BrowserCore.exe
+   filter_realbrowsercore:
+      Image|endswith: '\BrowserCore.exe'
+   condition: selection and not 1 of filter*
+falsepositives:
+    - Unknown
+level: high