Detect device token stealing with WDAC

Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This rule uses a WDAC audit policy to ingest missing Microsoft Defender for Endpoint events. By doing this, we can detect PRT token stealing on a device when exploiting the MicrosoftAccountTokenProvider.dll. For more detailed information on the WDAC audit policy, see the blogpost added in the references.

MITRE ATT&CK coverage

Tactic	Techniques
Credential Access	`T1212` Exploitation for Credential Access `T1528` Steal Application Access Token `T1539` Steal Web Session Cookie `T1606.001` Forge Web Credentials: Web Cookies

References

https://hybridbrothers.com/using-wdac-to-ingest-missing-mde-events/

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceEvents` action `any`: Defender event

Rule body

DeviceEvents
| where ActionType startswith "AppControl"
| where FileName =~ "MicrosoftAccountTokenProvider.dll"
| invoke FileProfile(InitiatingProcessSHA1, 1000)
| where GlobalPrevalence < 250

Stages and Predicates

Stage 1: `source`

DeviceEvents

Stage 2: `where`

| where ActionType startswith "AppControl"

Stage 3: `where`

| where FileName =~ "MicrosoftAccountTokenProvider.dll"

Stage 4: `invoke`

| invoke FileProfile(InitiatingProcessSHA1, 1000)

Stage 5: `where`

| where GlobalPrevalence < 250

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ActionType`	starts_with	`AppControl`	`field:"ActionType" kind:starts_with value:"AppControl"`
`FileName`	eq	`MicrosoftAccountTokenProvider.dll`	`field:"file_name" kind:eq value:"MicrosoftAccountTokenProvider.dll"`
`GlobalPrevalence`	lt	`250`	`field:"GlobalPrevalence" kind:lt value:"250"`