Detection rules › Kusto
Detect device token stealing with WDAC
This rule uses a WDAC audit policy to ingest missing Microsoft Defender for Endpoint events. By doing this, we can detect PRT token stealing on a device when exploiting the MicrosoftAccountTokenProvider.dll. For more detailed information on the WDAC audit policy, see the blogpost added in the references.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Credential Access | T1212 Exploitation for Credential Access, T1528 Steal Application Access Token, T1539 Steal Web Session Cookie, T1606.001 Forge Web Credentials: Web Cookies |
References
Event coverage
| Provider | ActionType | Title |
|---|---|---|
| Defender-DeviceEvents | any | Defender event (any) |
Rule body yaml
DeviceEvents
| where ActionType startswith "AppControl"
| where FileName =~ "MicrosoftAccountTokenProvider.dll"
| invoke FileProfile(InitiatingProcessSHA1, 1000)
| where GlobalPrevalence < 250
Stages and Predicates
Stage 1: source
DeviceEvents
Stage 2: where
| where ActionType startswith "AppControl"
Stage 3: where
| where FileName =~ "MicrosoftAccountTokenProvider.dll"
Stage 4: invoke
| invoke FileProfile(InitiatingProcessSHA1, 1000)
Stage 5: where
| where GlobalPrevalence < 250
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ActionType | starts_with |
|
FileName | eq |
|
GlobalPrevalence | lt |
|