Renamed BrowserCore.EXE Execution
This rule detects the execution of 'BrowserCore.exe' when its filename has been changed from the original. Adversaries may rename this legitimate utility, which is known to be used for extracting Azure tokens, to evade detection. The rule specifically looks for processes where the original filename is 'BrowserCore.exe' but the executed image path does not end with '\BrowserCore.exe'.
Sigma
