Entra ID PRT Extraction via BrowserCore.exe Abuse

BrowserCore.exe is a native-messaging helper component used by Chromium-based browsers like Microsoft Edge and Google Chrome to broker communications between the browser and the Windows Web Account Manager (WAM). This component facilitates single sign-on (SSO) and Entra ID authentication operations. Threat actors have been observed abusing BrowserCore.exe to perform unauthorized extraction of Entra ID Primary Refresh Tokens (PRTs).

By invoking BrowserCore.exe directly - bypassing the browser's native-messaging host context - attackers can interact with WAM to export sensitive session tokens. Legitimate browser-initiated calls to BrowserCore.exe are always accompanied by a specific command-line argument containing a 'chrome-extension://' URI. Adversaries utilize tools like PRTRemote and PrtExtractor to execute the binary without this required argument, allowing for silent token harvesting that facilitates session hijacking and persistent access to cloud resources. Defenders should monitor for BrowserCore.exe processes spawned by non-browser parent processes or those missing the expected extension argument.

Attack Chain

1. Attacker gains initial access to the target Windows endpoint.
2. Attacker drops credential theft tools such as PRTRemote or PrtExtractor onto the local disk.
3. Attacker establishes persistence or triggers execution via a scheduled task, malicious script, or manual command-line execution.
4. The malicious script or tool spawns 'BrowserCore.exe' as a child process.
5. The attacker executes the process without the legitimate 'chrome-extension://' command-line argument.
6. The process interacts with the Windows Web Account Manager (WAM) via the native-messaging interface.
7. The tool exfiltrates the Primary Refresh Token (PRT) from the WAM store.
8. Attacker uses the stolen PRT to perform session hijacking or unauthorized access to Entra ID-protected applications.

Impact

Successful exploitation results in the theft of Entra ID Primary Refresh Tokens (PRTs), allowing attackers to bypass multi-factor authentication (MFA) and conditional access policies. This enables persistent unauthorized access to the victim's cloud-based accounts and corporate resources until the compromised tokens are revoked or credentials are rotated.

Recommendation

• Implement the detection rule provided below to identify anomalous executions of BrowserCore.exe.
• Prioritize investigation of BrowserCore.exe processes spawned by unexpected parent processes (e.g., cmd.exe, powershell.exe, wscript.exe, or svchost.exe/scheduled tasks).
• Verify that all legitimate executions of BrowserCore.exe contain the 'chrome-extension://' URI in the command-line arguments.
• If token extraction is confirmed, perform an immediate incident response: isolate the host, revoke all active Entra ID refresh tokens for the affected user, and mandate a credential rotation.
• Hunt for the presence of known credential extraction tools (e.g., PRTRemote, PrtExtractor) across the endpoint fleet using file hash and path telemetry.