Sigma rule: Potential Azure Browser SSO Abuse

Rule

Title

Potential Azure Browser SSO Abuse

Status

test

Level

low

Author

Den Iuzvyk

Date

2020-07-15

Modified

2023-04-18

File

rules/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser.
An attacker can use this to authenticate to Azure AD in a browser as that user.

Log source

product

windows

category

image_load

Detection

selection:
    ImageLoaded: 'C:\Windows\System32\MicrosoftAccountTokenProvider.dll'
filter_main_bgtaskhost:
    Image|startswith:
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
    Image|endswith: '\BackgroundTaskHost.exe'
    # CommandLine|contains: '-ServerNameBackgroundTaskHost.WebAccountProvider'
filter_optional_devenv:
    Image|startswith:
        - 'C:\Program Files\Microsoft Visual Studio\'
        - 'C:\Program Files (x86)\Microsoft Visual Studio\'
    Image|endswith: '\IDE\devenv.exe'
filter_optional_ie:
    Image:
        - 'C:\Program Files (x86)\Internet Explorer\iexplore.exe'
        - 'C:\Program Files\Internet Explorer\iexplore.exe'
filter_optional_edge_1:
    - Image|startswith: 'C:\Program Files (x86)\Microsoft\EdgeWebView\Application\'
    - Image|endswith: '\WindowsApps\MicrosoftEdge.exe'
    - Image:
          - 'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe'
          - 'C:\Program Files\Microsoft\Edge\Application\msedge.exe'
filter_optional_edge_2:
    Image|startswith:
        - 'C:\Program Files (x86)\Microsoft\EdgeCore\'
        - 'C:\Program Files\Microsoft\EdgeCore\'
    Image|endswith:
        - '\msedge.exe'
        - '\msedgewebview2.exe'
filter_optional_onedrive:
    Image|endswith: '\AppData\Local\Microsoft\OneDrive\OneDrive.exe'
filter_optional_null:
    Image: null
condition: selection and not 1 of filter_main_* and not 1 of filter_optional_*

False positives (as the rule lists them)

• False positives are expected since this rules is only looking for the DLL load event. This rule is better used in correlation with related activity

Tags

• attack.persistence
• attack.privilege-escalation
• attack.execution
• attack.stealth
• attack.t1574.001

MITRE ATT&CK ids this rule names

• T1574.001

References

• https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/image_load/image_load_dll_azure_microsoft_account_token_provider_dll_load.yml